A bunch of questions of permissions with a web server (Cherokee)

Question

I'm new with Linux administration and I'm configuring a Cherokee Web Server.

I'm using Archlinux so I have a http user that owns /srv/http. On the other hand I have a user called 'jesus' that is inside the http group.

Cherokee is working with user and group http (http:http)

So I made some changes to /srv/http. I added permissions to the group to write there and I changed the owner and group like:

drwxrwxr-x  3 jesus http 4096 Oct 25 14:00 http

It was like:

So now python can write his .pyc files there (I think that cherokee tell python to create that and because cherokee is able to write there).

My questions are: Is this permission stuff correct? Someone told me that the group shouldn't have write permissions and is better if I have the http folder (and my websites inside) like:

drwxr-xr-x  3 http http 4096 Oct 25 14:00 http

So cherokee will be able to write inside because http owns the folder.

Meh, I'm confused.

So, what permissions should have my http folder and everything inside it and what user & group should own that?

I just need my personal websites to run without big security issues :P

Thanks!

PS: Maybe this is related. When python creates his .pyc files, they are -rw-r--r--. Is that correct too?

Answer 1

On the other hand I have a user called 'jesus' that is inside the http group.

the user I use for accessing to the system (ssh) and also have a ts3 running. I thought that since the webs are mine, the user would be that one.

The system users which has shell access shouldn't be added to the http group. To write some testing files in the document root, you can switch to http user with:

$ sudo su - http -s /bin/bash

For the FTP purpose, you had better create a new user without shell access:

$ sudo useradd -d /home/ftp/ftpu1 -s /sbin/nologin ftpu1
$ sudo usermod -a -G nobody ftpu1
$ sudo mount --bind /srv/http/web1 /home/ftp/ftpu1

or use virtual users.

The correct permission and ownership for the document root should be:

drwxrwsr-x 8 http nobody 4096 Oct 17 15:36 /srv/http/

Pay attention to the s at group execute bit location. It means that this folder is set SGID, the newly created files/folders also have the same group ownership.

Don't forget to set umask for the Apache and the FTP server to 002 to make the files/folders created by http can be overwrite by nobody and vise versa.