Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to know what is a correct way to set up permissions for directory /var/www/example.com and all the files in it. The entire server will be used to set up my sites only so I'm not sure if it is even necessary to create a new user for each of my site. Apache runs as www-user:www-user. It would be also great if you could explain a little from security point of view.

EDIT It looks like I do need to run 2 sites as separate users simply because one of the sites will have to be as secure and as separated as possible from the other, which I expect to be much more vulnerable (vbulletin forum). Being able to compromise supposedly secure site through less secure one is unacceptable for me.

share|improve this question

3 Answers 3

up vote 3 down vote accepted

I use apache-itk with a separate user for each site. There's extra overhead since each new request has to start a new process as that user, but it really makes things much neater from a security point of view as one particular site cannot access the files of another. It also helps if one particular site is consuming too many resources and so on.

On Debian/Ubuntu:

apt-get install apache2-mpm-itk

Then add:

<IfModule mpm_itk_module>
    AssignUserId USER GROUP
</IfModule>

In your apache2's VirtualHost, replacing USER and GROUP with your own.

share|improve this answer
    
Very interesting answer indeed. Never heard of apache-itk before, but it seems it is something I need since I need to somehow make 1 of the sites more secure than the others, this looks like a good way to do it. It also looks like I still need to create separate users and also assign permissions for webroot directories. For adding a user I would use "useradd -M -d /var/www/example.com -s /sbin/nologin username -p password" and then "chmod -R 755 /var/www/example.com" and "chown -R username:username /var/www/example.com" . Is this the correct way of doing it? –  jaz Aug 18 '11 at 9:23

How you set up the permissions depends on your security and threat models. And we don't know what those are.

But in general, files/directories should only be readable by the uids which need to read them and should only bne writeable by the uids which need to write them. Sometimes this is not always practical to map directly to the Unix permissions model, so the next principle which usually applies is that accidental information disclosure is usually preferable to unauthorized data modification.

What this means in your case, is that none of the files/directories within the webserver document tree should be writeable by the webserver uid. In some cases that might entail mounting the filesystem read-only. But obviously this makes life more complicated when you want to change your content. So who changes the content? If it's a single user (and will always be a single user) then your permissions might be:

-rw-r----- devuser wwwuser somefile
drwxr-s--- devuser wwwuser somedir

So your webserver gets access via group ownership. The sticky group bit ensures that directories / filse created inherit the same group.

If you've got multiple users changing files, then add them all to a group (say, webdev) and make the webserver access via the 'other' permissions:

-rw-rw-r-- devuser webdev somefile
drwxrxsr-x devuser webdev somedir

Certainly there are additional tools which can add further privilege seperation - but I would only consider looking at these if you're setting up a shared host and need to isolate each vhost.

share|improve this answer
    
+1, exactly my view, but better said. Not allowing the web server to write stuff does break some content though (like caching plugins, or wordpress) so it's not always viable across the board. –  EightBitTony Aug 18 '11 at 10:36
    
@symcbean Thank you, your answer certainly helps me to understand how permissions work for apache however it seems this is not what I'm looking for. I have updated my question with some information of the security model and it looks like Edward's answer reflects more of what I'm actually looking for. –  jaz Aug 18 '11 at 10:59

If you're the only one using the web server, then stuff like mpm_itk is overkill.

Just set the permissions to the same user that the web server / php run as (www-user:www-user in your case).

The only reason to isolate the permissions are to protect one site from being hacked if the web server running another site also gets hacked. If all the sites are yours, then that's no where near as big an issue.

I see lots and lots of walkthroughs which seem to imply you must set up the security like that and it's dangerous not to. That's entirely untrue. The www-user user has no permission to anything on your server other than your web server directory, so it's perfectly safe to leave the web root and everything below it set to 770/660 and www-user:www-user.

Worst case, one of your virtualhosts is hacked and they scrub all your stuff in the other virtualhosts, but then, you need to restore the entire server anyway, because any break in means you can't trust it.

Sure, if you're hosting stuff for other people, or if you have lots of users logging in who want their own isolated Apache stuff you need to consider options, but for a personal server with a few virtualhosts, there's nothing wrong with leaving everything owned by the web server user.

share|improve this answer
    
Thank you for a very thorough explanation. It looks like I do need to run 2 sites as separate users simply because one of the sites will have to be as secure and as separated as possible from the other, which I expect to be much more vulnerable (vbulletin forum). Being able to compromise supposedly secure site through less secure one is unacceptable for me. Sorry I didn't mention it in my question. I really don't know which answer to accept now, yours or Edward's –  jaz Aug 18 '11 at 10:46
    
Edwards, it answers your question more fully. –  EightBitTony Aug 18 '11 at 11:15
    
Thanks to your answer I now understand why I need something like suexec or mpm-itk. I would accept your answer as well if I could. I'll have to wait until I get more rep to vote your answer up though so stay tuned :) –  jaz Aug 18 '11 at 11:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.