Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm going to host a really simple, static, readonly website on apache but failed with file permission settings.

Here's my config file under /etc/apache2 which is OK:

<VirtualHost *:80>
    ServerAdmin xxx@yyy.com

    DocumentRoot /home/jeffz/sites/main/root/
    ServerName some-url.com

    ErrorLog /home/jeffz/sites/main/logs/apache-error.log
...

and the file permissions:

$ ls -l / | grep home
drwxr-xr-x   5 root root  4096 2010-09-29 09:06 home

$ ls -l /home | grep jeffz
drwsrwsr-x 7 jeffz jeffz  4096 2010-10-09 10:18 jeffz

$ ls -l /home/jeffz | grep sites
drwx--x--x 6 jeffz sites-web 4096 2010-09-12 15:26 sites

and www-data (which is the account running apache) is in group sites-web:

$ cat /etc/group | grep sites-web
sites-web:x:1002:www-data

It work perfectly fine now since I set the permission 711 to the sites, but when I set the permission 710 and Apache shows permission denied.

Does Apache use another account instead of www-data to load file from the file system? How can I remove the last x permission from sites folder?

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

As ultrasawblade suggests

You want

  • Jeffz to be able to edit the files.
  • Web users, in group www-data, to be able to read them.
  • Everyone else to have no access.

You need

  • To apply this recursively to existing directories and files.
  • The group settings to apply to newly created subdirectories and files.

So

chgrp -R www-data /home/jeffz/sites/main/root/ 
chmod -R u+rwx,g+srx,o-rwx /home/jeffz/sites/main/root/
cd /home/jeffz/sites/main/root/
chmod -R ugo-x *html

Notes

The -R option means apply recursively to all contents and subdirectories.

The x permission is only needed on directories. Having it set on files shouldn't hurt unless Apache is configured to use that as a hint for dynamic content.

The s permission is what makes new files and subdirectories inherit the parent's group.

You should set your umask appropriately before creating files or explicitly alter file permissions after creation.

P.S.

Instead of

ls -l / | grep home

Try

ls -ld /home
share|improve this answer
    
It works, thank you very much indeed! –  Jeffrey Zhao Nov 2 '10 at 11:29
add comment

The files that you are pointing the DocumentRoot directive towards must be readable by the the user and group Apache runs as.

Apache is running as www-data:www-data. Your directories are owned by jeffz:sites-web.

So, you must go into /etc/apache2/envvars and change the APACHE_RUN_USER to jeffz, and APACHE_RUN_GROUP to sites-web to get things working how you expect.

If you are on a shared host and cannot edit the Apache configuration, then you must chmod your files to at least the same group that Apache is running as, which is likely www-data.

share|improve this answer
    
It seems that APACHE_RUN_USER and APACHE_RUN_GROUP are global setting which would affect all the sites host in apache. So I've set "www-data:www-data" as the owner of sites folder and the website works ok (with 770 permission). But strangely I always met "Permission denied" when I tries to do something with account "jeffz" although I've already put it into group "www-data". –  Jeffrey Zhao Oct 9 '10 at 3:04
    
Try setting your website files to chmod 750. This prevents anyone that isn't the owner or in the group from accessing them, and allows those in the group but not being the owner to only read/execute the files. –  ultrasawblade Oct 9 '10 at 5:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.