Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know how to setup Apache server and get multiple sites working but this question is more about best practice.

Basically I have a VPS running Ubuntu server, and I am looking to run multiple sites from this. What I would like to do is setup each account a directory within the home folders, but have my sites account able to make, modify and delete files within each of these folders without having to use root permissions. Is this possible, and if it is, is this an acceptable way to setup my environment.

share|improve this question

migrated from superuser.com Mar 4 '13 at 21:16

This question came from our site for computer enthusiasts and power users.

2 Answers 2

up vote 0 down vote accepted

Thank you user204088 - a question about permissions which describes a security model! (most people just moan they can't get stuff to work, and accept the answer that says change the permissions to 0777).

One thing you didn't mention is how the sites get created, and how they get modified, and how much isolation there should be between sites.

A couple of things of note:

1) I would recommend setting the document root to be a folder below the home folder. That way you can have scope for a per-site include directory, a per-site uploads directory and a per-site session data directory none of which are served up as URLs by the webserver. It also means that all the junk from /etc/skel isn't accessible either.

2) Except in very rare circumstances, your webserver should not have write access to any content within the documentroot.

In order to create users (with home directories) you need to be root - hence I'd go with setting up a template site in /etc/skel and writing a simple bash script to create a user and add a vhost record to the httpd.conf (on my PCLinux box this goes in /etc/httpd/conf/vhosts.d - name the file the same as the hostname, less the www. prefix

Allowing the sites account read/write access to all the sites content is where it gets messy. You could set up a common group and ensure that all files/directories are group writable (chmod g+S) but this means that users can access each other's content. It's probably a better idea to go with the one group per user model, set the file permissions as writeable by the group and add the 'sites' account to each of the single-user groups.

Apache gets read access to the files/directories via the 'other' - so remember to set the umask appropriately.

Bundling this all up into a bash script runnable only by root is simple. You can do stuff like invoke this via sudo (make sure you add further authentication) from your webserver to put a simple front end on the creation of accounts/vhosts.

And once the user account is created you can manipulate the files using the 'sites' account.

share|improve this answer
    
Thanks for your answer @symcbean, I will give you some rep once I can. –  user204088 Mar 14 '13 at 15:58

It is possible and if you find it as an acceptable way to maintain your server, I don't see why it isn't a viable option. An alternative would be not to have the sites user and run a script as apache or whatever web service user you use.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.