Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite
1

I always did this:

  1. chown apache2:apache2 /var/www/ -vR
  2. chmod 555 /var/www/ -vR
  3. chmod 755 /var/www/a/special/dir/which/needs/write/permissions/ -vR
  4. OR instead of 2, 3 just set permissions to 755

Recently I came to know that setting apache as user is not secure, how come? And what are the alternatives?

What are other good practices for increasing a webserver (apache) security?

share|improve this question

2 Answers

up vote 1 down vote accepted

You may want to investigate chroot-ing your web-servers as well. Better yet, run each application in its own virtual machine with its own apache and what nots. That way, even if compromised, the only vulnerable machine is the VM one.

However, when you talk about apache security, you should be a little more specific about what kind of attacks are you interested in protecting against.

share|improve this answer
okay, i know about mod-chroot but what about running each application in its own vm? can you provide some instructions or may be a link? And when i said "apache security" i was talking about things that are considered under the category "Better safe than sorry" – Shoaibi Sep 30 '09 at 10:29
Also when you talked about chroot, what did you meant: chroot to /var/www OR chroot to /var/www/vhost1 in vhost configuration of every vhost? – Shoaibi Sep 30 '09 at 10:34
All these things are forms of isolation. A VM isolation would be the most isolated case. You can treat each VM just like any other machine. So, install Apache as you would on a normal non-VM machine. – sybreon Oct 1 '09 at 5:14
What you choose to chroot would depend on what you want to isolate. I would probably do it on /var/www. However, keep in mind that when you chroot, you will need to do some other customisations. – sybreon Oct 1 '09 at 5:16
up vote 2 down vote

If the Apache user is also the owner of the directories/files, in case of any vulnerability (or even bug in your web application), the attacker will be able to delete, change permissions and do anything with your files.

The correct way is to set the ownership to root (or your user name) and give the Apache group only permission to read the files. Something like:

# chown -R root:apache2 /var/www
# chmod -R 550 /var/www

In the directories that apache needs to write, just give the 570 permissions.

That way, no other user in the system can access your web files (which would include mysql passwords, etc) and Apache itself can't delete them either.

share|improve this answer
This answer sounds like a good solution to me - can anyone tell me any downsides? – thomasrutter Mar 22 '11 at 14:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.