1

I want to enable apache to automatically create files/directories.

In some web hosts, for example, when I install wordpress, apache is able to automatically createwp-config.php file.

But In my VPS, I have to manually create wp-config.php file.

I know that doing chmod 777 is dangerous and chown apache:apache makes the previous owner can't write to these files.

How can I do this? Do I have to set apache's User and Group dynamically?

2 Answers 2

-1

Try using these commands from any directory you want the server to be able to access.

chmod 775 .
chgrp apache .

This will allow the web server to write to the directory even if it doesn't own it. (I am assuming the group used by your web server is apache.)

Once the file is created, you can change the permission to prevent writing new files to the directory with the command (again run from the directory).

chmod 755 .

You can substitute the directory path for . in all the above commands.

Try to limit the number of files and directories your server can write to. These locations can be used to store malware if your web server is compromised.

9
  • The server does not need to be compromised for these to store malware. There is a huge list of things you need to do to mitigate the abuse of a directory writeable by the webserver uid - exactly what security model is applicable depends on how the facility is intended to be used. This is better chan chmod 0777
    – symcbean
    Dec 29, 2013 at 0:03
  • (should say this is no better than chmod 0777)
    – symcbean
    Dec 29, 2013 at 19:30
  • 0775 is better, as 0777 allows anyone with access to the server to write the directory.
    – BillThor
    Dec 29, 2013 at 22:22
  • And who exactly would that be (bearing in mind that even if this is a shared host, all the vhosts are running as the same uid)?
    – symcbean
    Dec 29, 2013 at 22:25
  • @symcbean Any userid with access to the server. I would expect the various content owners to each have a different uid. There may be other uids for other users and services. 0777 allows anyone of these ids to modify (add/remove/replace) content. 0775 limits modifications to the directory owner and members of the web-server's group. Normally the web server is the only user/uid in that group.
    – BillThor
    Dec 30, 2013 at 5:03
-1

You can create multiple logins with the same uid:gid. F.e. logins apache, www, site and developer all can be assigned to the uid=80. That allow to keep existing users while new equivalent accounts would be added easily.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .