Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to set up apache2 to achieve the following

  • Several different login accounts can access their own files and read / write / replace them at will.
  • Each user can't even read the contents of the other users files, or preferably even see they files exist.
  • All of them can be properly accessed by apache and php

Each user looks after a different subdirectory of a /var/www/{hostname} website. I can't allow each user to see the other people's files as they may contain database login details for example in config.php

How do I set the file permissions and file / directory ownership to achieve this.

It would be a bonus if I could give more than one account the permission to access a specific set of files. It would be a bonus if autoupdate mechanisms for things like wordpress worked properly with the permission setup.

I've looked at user and group ownership and permissions but can't seem wo work out how to achieve exactly what I need.

Any suggestions would be welcome :)

Edit: This is on a linux debian "lenny" system

share|improve this question

1 Answer 1

  • Using the apache module LDAPUserDir makes homedir's available to them. You need to have a LDAP server that contains your user info.

    LDAPUserDir /home/
    LDAPUserDirDNInfo cn=admin,dc=YOURDOMAIN,dc=com PASSWORD
    LDAPUserDirBaseDN ou=People,dc=YOURDOMAIN,dc=com
    LDAPUSerDirServer localhost
    LDAPUserDirFilter "(&(uid=%u)(objectClass=posixAccount))"
    
    
    <Directory /home/*>
            DAV on
            Options Indexes FollowSymLinks Includes MultiViews
            Authtype basic
            AuthName "YOUHOSTSTANZA"
            AuthBasicProvider ldap
            AuthzLDAPAuthoritative off
            AuthLDAPURL "ldap://localhost"
            AuthLDAPURL "ldap://localhost:389/ou=People,dc=DOMAIN,dc=com?uid"
            <Limit GET PUT PATCH PROPPATCH MKCOL COPY MOVE LOCK UNLOCK POST OPTIONS PROPFIND>
                    Require valid-user
                    Order allow,deny
                    Allow from all
            </Limit>
    
    
    </Directory>
    
  • To make sure that apache/php can read/write in all these folders add the user that apache runs under (www-data by default) has permissions by modifying the ACLs for these dir's like :

    setfacl -m user:www-data:rwx
    
  • If you're filesystem/kernel doesn't allow ACLs you can add www-data to the group your users are in and set all the permissions to 0664 (files) and 0775 (for dir's).

This probably needs some fiddling to get PHP stuff to create new files with the right permissions, maybe even changing the group apache runs under (again, by default www-data) to the group your users are in. LDAPUserDir is noy by default installed on Debian, so you have to install it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.