I need to set up apache2 to achieve the following

  • Several different login accounts can access their own files and read / write / replace them at will.
  • Each user can't even read the contents of the other users files, or preferably even see they files exist.
  • All of them can be properly accessed by apache and php

Each user looks after a different subdirectory of a /var/www/{hostname} website. I can't allow each user to see the other people's files as they may contain database login details for example in config.php

How do I set the file permissions and file / directory ownership to achieve this.

It would be a bonus if I could give more than one account the permission to access a specific set of files. It would be a bonus if autoupdate mechanisms for things like wordpress worked properly with the permission setup.

I've looked at user and group ownership and permissions but can't seem wo work out how to achieve exactly what I need.

Any suggestions would be welcome :)

Edit: This is on a linux debian "lenny" system

1 Answer 1

  • Using the apache module LDAPUserDir makes homedir's available to them. You need to have a LDAP server that contains your user info.

    LDAPUserDir /home/
    LDAPUserDirDNInfo cn=admin,dc=YOURDOMAIN,dc=com PASSWORD
    LDAPUserDirBaseDN ou=People,dc=YOURDOMAIN,dc=com
    LDAPUSerDirServer localhost
    LDAPUserDirFilter "(&(uid=%u)(objectClass=posixAccount))"
    <Directory /home/*>
            DAV on
            Options Indexes FollowSymLinks Includes MultiViews
            Authtype basic
            AuthName "YOUHOSTSTANZA"
            AuthBasicProvider ldap
            AuthzLDAPAuthoritative off
            AuthLDAPURL "ldap://localhost"
            AuthLDAPURL "ldap://localhost:389/ou=People,dc=DOMAIN,dc=com?uid"
                    Require valid-user
                    Order allow,deny
                    Allow from all
  • To make sure that apache/php can read/write in all these folders add the user that apache runs under (www-data by default) has permissions by modifying the ACLs for these dir's like :

    setfacl -m user:www-data:rwx
  • If you're filesystem/kernel doesn't allow ACLs you can add www-data to the group your users are in and set all the permissions to 0664 (files) and 0775 (for dir's).

This probably needs some fiddling to get PHP stuff to create new files with the right permissions, maybe even changing the group apache runs under (again, by default www-data) to the group your users are in. LDAPUserDir is noy by default installed on Debian, so you have to install it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .