Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have some files that nobody needs read access to and apache needs read and write access to.

Should I do

chown nobody.apache file
chmod 460 file

or

chown apache.nobody file
chmod 640 file

or perhaps something else?

share|improve this question

closed as off-topic by Magellan, Falcon Momot, dawud, mdpc, Nathan C Oct 10 '13 at 17:40

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – Magellan, Falcon Momot, dawud, mdpc, Nathan C
If this question can be reworded to fit the rules in the help center, please edit the question.

2  
Be careful when giving access to nobody. I assume you're doing that because a process is running as nobody, but that is a general-purpose restricted access user and you might be granting access to more than you think. Take a look to see how many processes are running as nobody before using it for permissions. –  Kyle Smith Feb 20 '12 at 14:24
    
Yes, that is exactly the case. openvpn is running as nobody so somehow nobody needs read permission to the secret certificates. nobody needs read access to the secret index.txt file and apache needs both read and write to this file also. –  Sandra Feb 20 '12 at 14:34
    
No! No, no, no, no! No!! You should drop privileges instead using the user and group configuration directives, and restrict the keys to whoever will be launching it (preferably root). If you create such a travesty everyone who has a shell will also have access to your VPN. –  Falcon Momot Oct 10 '13 at 6:56
add comment

2 Answers 2

up vote 3 down vote accepted

Based on your comment about secret certificates, you should definitely create a separate user to run OpenVPN (one called "openvpn" might be a good choice). The nobody user is (like Kyle Smith said) used as a general-purpose restricted access user, and you might be unwittingly giving access to your OpenVPN certificates to, say, anonymous FTP users.

I'd be inclined to solve the index.txt problem by adding the apache user to the openvpn group and make the file group-readable.

So:

  1. create an openvpn user
  2. run OpenVPN as that user
  3. usermod --append --groups openvpn apache
  4. chown openvpn:openvpn /path/to/certificates /path/to/index.txt
  5. chmod 600 /path/to/certificates
  6. chmod 640 /path/to/index.txt
share|improve this answer
    
Does the 3. command make the openvpn user member of the apache group? –  Sandra Feb 20 '12 at 15:28
1  
No, it makes the apache user a member of the openvpn group –  nickgrim Feb 20 '12 at 15:36
add comment

The first one does not make much sense, as usually the user should be the one with more rights, and the user can still change the rights of its own files (this is not what you want).

So, expecting nobody is the only user of the nobody group, you should go for your 2nd solution:

chown apache:nobody file
chmod 640 file
share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.