Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm new with Linux administration and I'm configuring a Cherokee Web Server.

I'm using Archlinux so I have a http user that owns /srv/http. On the other hand I have a user called 'jesus' that is inside the http group.

Cherokee is working with user and group http (http:http)

So I made some changes to /srv/http. I added permissions to the group to write there and I changed the owner and group like:

drwxrwxr-x  3 jesus http 4096 Oct 25 14:00 http

It was like:

So now python can write his .pyc files there (I think that cherokee tell python to create that and because cherokee is able to write there).

My questions are: Is this permission stuff correct? Someone told me that the group shouldn't have write permissions and is better if I have the http folder (and my websites inside) like:

drwxr-xr-x  3 http http 4096 Oct 25 14:00 http

So cherokee will be able to write inside because http owns the folder.

Meh, I'm confused.

So, what permissions should have my http folder and everything inside it and what user & group should own that?

I just need my personal websites to run without big security issues :P

Thanks!

PS: Maybe this is related. When python creates his .pyc files, they are -rw-r--r--. Is that correct too?

share|improve this question
    
What purpose the jesus user is used for? –  quanta Oct 25 '11 at 16:37
    
is my user, the user I use for accessing to the system (ssh) and also have a ts3 running. I thought that since the webs are mine, the user would be that one. But I'm wrong right? :) –  Jesus Rodriguez Oct 25 '11 at 16:41
    
Do you need a FTP server for uploading codes to /srv/http? –  quanta Oct 25 '11 at 16:48
    
well, I will need that. So far im using sftp because I picked the vps yesterday and first I'm trying to leave the cherokee perfect for django deployment :) –  Jesus Rodriguez Oct 25 '11 at 16:53
    
No problem with this permisison but the correct way is setup a FTP server and take a look at this: serverfault.com/questions/184548/… –  quanta Oct 26 '11 at 0:02

1 Answer 1

up vote 1 down vote accepted

On the other hand I have a user called 'jesus' that is inside the http group.

the user I use for accessing to the system (ssh) and also have a ts3 running. I thought that since the webs are mine, the user would be that one.

The system users which has shell access shouldn't be added to the http group. To write some testing files in the document root, you can switch to http user with:

$ sudo su - http -s /bin/bash

For the FTP purpose, you had better create a new user without shell access:

$ sudo useradd -d /home/ftp/ftpu1 -s /sbin/nologin ftpu1
$ sudo usermod -a -G nobody ftpu1
$ sudo mount --bind /srv/http/web1 /home/ftp/ftpu1

or use virtual users.

The correct permission and ownership for the document root should be:

drwxrwsr-x 8 http nobody 4096 Oct 17 15:36 /srv/http/

Pay attention to the s at group execute bit location. It means that this folder is set SGID, the newly created files/folders also have the same group ownership.

Don't forget to set umask for the Apache and the FTP server to 002 to make the files/folders created by http can be overwrite by nobody and vise versa.

share|improve this answer
    
Im looking the new stuff you said but Im confused. The group was webgroup and not nobody, right? (webgroup is for nobody and http too) And the rws umask on the group. I like it. Can I put that on the user so every file will be owned by http by default? And I don't understant the last paragraph. cherokee (im not using apache) creates the files owned by http by default and nobody is in the group. –  Jesus Rodriguez Oct 26 '11 at 15:54
    
You can add http to nobody group and nobody user to http group or add both of them to a common group (webgroup). What do you mean when you said "Can I put that on the user"? –  quanta Oct 26 '11 at 15:59
    
That's weird, I mean, is not easier to add http and nobody users to webgroup? So, you mean to add http user to nobody group and nobody user to http group and add both groups to webgroup?. With "Can I put that on the user" I meant the 's', something like u+s :P –  Jesus Rodriguez Oct 26 '11 at 16:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.