Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am in the process to migrate to a new web server and I would like to have a clean and safe file architecture for apache and my web application.

The server will serve one single php/mysql application. This application receive files from FTP and webservices and generate logs files.

The server OS is CentOS 5.4.

The default Apache document root is /var/www/html.

Should I put my web application directory under :

  • /var/www/html/myWebApp?
  • /www/myWebApp?
  • /home/www/myWebApp?
  • Somewhere else?

The application directory should be owned by the root user or apache user or an other user?

Thanks for your help.

share|improve this question
    
For the people who are getting mad just like me: If you are using centos or an other RHEL disto there are program specific permissions you need. serverfault.com/a/409488/43746 –  Spidfire Jun 14 '13 at 19:23

3 Answers 3

up vote 4 down vote accepted

Assuming you have SELinux enabled, not all of those options will work due to SELinux denying access to non-standard folders by the httpd process.

IIRC, the preferred method for manually adding web applications on CentOS (e.g. a mediawiki install) is to install them to /var/www/<myappname> and create an Alias in the /etc/httpd/conf/httpd.conf file that points to your app (I usually pattern mine to be similar to the existing alias for the /var/www/icons folder).

Typical file ownership for anything under /var/www on CentOS is root.

share|improve this answer
    
File ownership should not be apache if that is also the user under which httpd is running, otherwise the web server can overwrite your application code if your permissions are not correct. –  Andy Feb 18 '10 at 9:10

It's really up to you, I would personally opt for CentOS's default DocumentRoot in /var/www/html/myWebApp as it maintains a clean, extensible and obvious structure for future maintainers etc.

You can own the application files yourself, however they should be readable (but not owned - unless the application has to overwrite/edit them) by the user and group that apache is configured to run as. This is usually nobody:nobody - and that user should be unprivileged (i.e. only able to read the files in your document root, nothing more).

More info here.

edit: For SVN checkout, you can leave the files owned by the SVN user (SVN or root I assume - as long as it's different from the user apache is running as) and permissions should be 644 (-rw-r--r--) - I believe this is what SVN will use by default, if not chmod the directory in the post-commit hook.

...and to determine if you have an SELinux issue, try disabling it and retesting. If that works, gather the logs and modify the HTTPD policy (possibly just enabling httpd_disable_trans). Or use Ophidian's method :)

share|improve this answer
    
Ok, So if we will be 3 web developers to work on the server and if the source file will be checkout from a SVN rep. Should I create a webdev user and group and make the application files own by webdev? Right now everything under /var/www/html is own by root. Is it a probleme? Thanks –  benjisail Feb 17 '10 at 14:38

(this should be a comment for Ophidian but it won't fit in the space allowed for a comment so I am posting it as a reply)

You can do it under selinux by chcon'ing the dirs/files you want to use with the appropriate contexts/type.

To find out the correct context the easiest method is to examine an already correctly labelled dir. E.g.

[root@somehost ~]# ls -ldZ /var/www/html drwxr-xr-x root root system_u:object_r:httpd_sys_content_t /var/www/html

Then set the correct se linux type on your new content dir. E.g. if you want to use /home/myapp as your doc root: chcon -t httpd_sys_content_t /home/myapp

chcon only persists until the next filesystem relabel. Don't forget to use semanage fcontext if you do so that the new contexts will persist through file system relabels!

semanage fcontext -at httpd_sys_content_t /home/myapp

share|improve this answer
    
Oh, I 100% agree. There are lots of ways around the SELinux limitations, but if we're discussing basic httpd configuration then I think getting into the vagaries of SELinux tuning is a likely bit much. :) –  Ophidian Feb 17 '10 at 21:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.