Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am fairly Apache2 savy, but have been tasked at my job to do the following;

Server currently has two vhosts. (Two totally separate clients) I was asked if I could create a user account by which the one of the clients would be able to have basically jailed FTP or SFTP (preferably) access only to their files.

The way the vhosts are currently laid out is that they both reside in; (client1 & 2 are obviously pseudonyms for the real names) /home/web/client1, and /home/web/public_html (client2) NOTE: All directories just listed are all web:web for owner:group. (I know this is going to have to change to achieve my desired outcome.)

My thoughts were to create a new user (call it, client1) and move their webroot to /home/client1/public_html and then set them up with an rssh account so that they can SFTP into their stuff only.

Where things start to get a bit more complicated for me is now I will have two different user accounts owning their respective web content directories and files and need Apache to be able to work for both, plus allowing that jailed access for the one client.

So, How do I set up each vhost so that the web server will serve up both sites? Do I need to do a chown client1:www-data in client1's public_html dir as well as chown client2:www-data or am I not even on the right track here?

As you can see, the problem actually is multi-faceted. So, try to be as verbose as possible with relation to both the vhost issue and the jailing issue.

Thanks folks.

share|improve this question
    
Does Apache need modify? And what privilege set are these files coming in with? Unless the files are coming in without world-readable permissions, no adjustment should be needed. –  Shane Madden Dec 16 '11 at 17:13
    
Not sure exactly what you're asking, but I'm assuming that you're referring to the permissions they will be set to upon transfer from the user. If that's what you meant then they'll have a umask set to 022 for resulting file perms of 644 and resulting dir perms of 755. –  Skittles Dec 16 '11 at 17:43
    
Right - so, unless the Apache process needs to write to those files, then I see no reason to change the owner user or group to www-data, since it should have all it needs with the 'others' permissions. Apache should work fine, it has no interest in owning the files as long as it has the permission to do what it needs to do, you should be able to focus on making the permissions support the FTP needs. –  Shane Madden Dec 16 '11 at 17:50
    
Well, that might be an issue. I know that one of the clients has a word press installation, which unless I'm mistaken, I believe that it requires some directories to be writable. Ultimately, I want the user to have the access they need to be able to install stuff like word press or an ecommerce package (as will be the case in this instance) which they also usually expect certain writeable directories. You still think this will work? –  Skittles Dec 16 '11 at 17:55
    
If they do need write, then yeah, you would need to look at messing with ownership. –  Shane Madden Dec 16 '11 at 18:07

2 Answers 2

up vote 0 down vote accepted

If this is a real issue for you (I'm not certain that it is though because Apache effectively 'jails' access via normal directives per vhost). But if you really want to nail the issue once and for all, you may consider using aliased IPs and totally separate apache instances bound to their respective IPs only. For example, client 1's apache is bound to IP address 192.168.0.11:80 (eth0:0), and client 2 goes to 192.168.0.12:80 (eth0:1), etc.

This will work, and it'll allow you totally separate those instances and do whatever you want. Hope this helps.

share|improve this answer
    
Well, I'm not entirely sure what Apache is doing in the background, but interestingly, when I create a virtual host that is pointed at a user's public_html directory located in their /home/user/public_html, Apache seems to be fine with serving the index.php file up. I wish I understood how that's possible. –  Skittles Dec 19 '11 at 17:49

I just checked the Apache httpd 2.2 documentation.

It seems there is no "User" directive per vhost. The only thing that comes near that idea is the "SuexecUserGroup" directive. But that only woks for cgis.

share|improve this answer
    
Yeah...I saw that also. –  Skittles Dec 19 '11 at 17:45
    
Well, I'm not entirely sure what Apache is doing in the background, but interestingly, when I create a virtual host that is pointed at a user's public_html directory located in their /home/user/public_html, Apache seems to be fine with serving the index.php file up. I wish I understood how that's possible. –  Skittles Dec 19 '11 at 17:48
    
Apache is running as www-data, yet it's serving up content from directories owned & grouped as anything but that. –  Skittles Dec 19 '11 at 18:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.