3

I just got my very own Linux (Debian Stable) server, and installed Apache2, PHP5 and MySQL. It's supposed to be used for hosting of my own and others websites.

As it is now, Apache is running as its own user. That means that I need to "chown" all files and folders in a webroot, to the Apache-user, or else Apache can't edit and/or delete them. That is a big problem in Wordpress when installing plugins and such.

I Google'd a little, and found a website which says that you need to run the user's Apache instance as their own user, instead of running Apache as its own user.

How do I do that?

Improve this question

4 Answers 4

Reset to default
3

For security and compatibility reasons, it is not such a great idea.

A better idea might be to use suexec, which executes each person's cgi's as them.

If you really want to do this

add 

User youruserid
Group yourgroupid

to your /etc/apache2/apache.conf

If you don't know where this goes in the file or think it might be a different file, scan for the strings User and Group. There may be a setting already.

Here's some documentation you might like

User directive http://httpd.apache.org/docs/2.0/mod/mpm_common.html#user

General apache2 http://httpd.apache.org/docs/2.0/

Improve this answer
8
  • I will take a closer look at suexec. But what about performance? Is there any performance-loss by using CGI?
    – Niklas H
    Commented Feb 13, 2010 at 20:15
  • Do you mean using suexec or using cgi? When using suexec there may be a performance hit, I would imagine not too much. I've never noticed it. If CGI I think this is another question. Some programs use fastcgi, and other techniques, which are faster than regular cgi.
    – Paul
    Commented Feb 13, 2010 at 20:24
  • Is it really so difficult to run chown and chmod to the web server's account -- if it is your server? An insecure cgi program will allow vandals to potentially look at or mess with anything owned by the web server's account.
    – Paul
    Commented Feb 13, 2010 at 20:26
  • The problem with doing chown, is that I will need to chmod 777 all the files aswell, or else I can't touch them through FTP. And I am not that excited about 777'ing everything.
    – Niklas H
    Commented Feb 13, 2010 at 20:34
  • 1
    If you are hosting for various users, then you want the suexec so that their scripts also work (if you want them to install scripts)
    – Paul
    Commented Feb 13, 2010 at 21:13
2

with apache2 you have the possibility to use the ITK multi-processing-module. This spawns off new processes running under the destination user's uid and gid. I'm using this for great effect on my hosting solution.

There should be packages for all major distributions available.

Improve this answer
1
  • I've used ITK extensively and found it both stable and easy to use. I used it while working for a web hosting company as well.
    – jemmille
    Commented Feb 14, 2010 at 1:22
2

I strongly recommend against having Apache run as any real user. If an exploit is found in your sites, a malicious user can read or alter your personal files.

WordPress will run fine with the files being owned by your user account and with Apache running as a different user. There are a few files and paths which you should chgrp to the same group as the Apache server and make group writable. That way Apache can make the necessary changes without the risk of a user having full access to the rest of your files.

You should read the WordPress document on Changing File Permissions.

Improve this answer
1

mpm-itk works good, it can be used also for non-php virtualhost.

If you need better scalability and performances, fastcgi pools are a better choice.

If you want to try something new, checkout php-fpm http://php-fpm.org/, debian lenny packages available on http://www.dotdeb.org/.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .