Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Are there any significant security concerns about adding users to the apache group? I am a programmer and I need access to all the files/directories in httpdocs - is there anything wrong with adding my user to that group?

share|improve this question

2 Answers 2

If you add apache user to your group - this is bad.

If you add you to apache group - where is a problem ?

share|improve this answer
1  
Because he's not only intending to add himself to the Apache group but he's also going to have to give the Apache group write access to the files order to achieve what he wants. Therefore Apache itself will have write access which is a security issue for the reasons I described. –  jdw Oct 3 '11 at 22:54
    
This seems spot on. My user was added to the Apache group, but is still not able to edit the files belonging to Apache. Which, I gather, is how things should be - I promise not to change that. –  doub1ejack Oct 4 '11 at 15:55
    
@KorjavinIvan - Would you mind explaining why it's bad to add the apache user to your user's default group? (I don't disagree with you; I just don't know, and I'd like to learn.) –  Andrew Cheong Apr 30 at 2:30

In your situation you do not want to do this as your intentions pose a significant security risk.

The Apache user/group should only have read access to the files in the web root. If your apache user has write access then you are open to having your application exploited and since it is running under a user that has write access, the attacker now has write access to your system.

I assume when you say that you need 'access' you mean that you want to write to the files. If you were going to achieve this by making yourself a member of the apache group, that would not meet your goal because (assuming you're running good permissions to begin with) your apache group does not have write access to the web files. You would also have to allow the group to write to the files in order to achieve what you want and then you're open to the type of attack I described in the second paragraph.

You should create a new group (www-admins or something) that has write access to those files and then add yourself to that group instead.

share|improve this answer
    
complete, 100% agreement ... Apache should not have write access to the document root. If you're running PHP or similar CGIs that allow uploads that are then served, you might have a limited directory they can write to, but you need to make sure that PHP won't interpret files in there, unless you really like your server being compromised and having to blank it and reinstall. (and you're still at risk for being used as a dropbox for online drugstore ads, PDFs with exploit code, etc.) –  Joe H. Oct 3 '11 at 20:31
    
I'm with you so far, please help me understand a little more: The files in question are primarily extensions to the Joomla CMS, so a PHP page is unpacking a .zip file and copying the contents throughout the web directory. So I guess it must be the Apache user that executes the PHP scripts, right? This ends up making it hard for a developer (Yours Truly) to edit these files. Should the PHP page run under a different user or should the developer have different permissions? –  doub1ejack Oct 4 '11 at 16:05
    
What are you using to connect? If SCP/SSH then you need to be either the owner of the files or you need to be in the group that owns the files AND the files have to writable by the group. If you're using FTP, then things are a little harder to explain because various FTP clients elevate their users privileges in a variety of ways. –  jdw Oct 4 '11 at 17:02
    
Using SSH primarily. –  doub1ejack Oct 4 '11 at 20:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.