File permissions and ownership to isolate users on apache

Question

I need to set up apache2 to achieve the following

• Several different login accounts can access their own files and read / write / replace them at will.
• Each user can't even read the contents of the other users files, or preferably even see they files exist.
• All of them can be properly accessed by apache and php

Each user looks after a different subdirectory of a /var/www/{hostname} website. I can't allow each user to see the other people's files as they may contain database login details for example in config.php

How do I set the file permissions and file / directory ownership to achieve this.

It would be a bonus if I could give more than one account the permission to access a specific set of files. It would be a bonus if autoupdate mechanisms for things like wordpress worked properly with the permission setup.

I've looked at user and group ownership and permissions but can't seem wo work out how to achieve exactly what I need.

Any suggestions would be welcome :)

Edit: This is on a linux debian "lenny" system

Answer 1

• Using the apache module LDAPUserDir makes homedir's available to them. You need to have a LDAP server that contains your user info.

  LDAPUserDir /home/
  LDAPUserDirDNInfo cn=admin,dc=YOURDOMAIN,dc=com PASSWORD
  LDAPUserDirBaseDN ou=People,dc=YOURDOMAIN,dc=com
  LDAPUSerDirServer localhost
  LDAPUserDirFilter "(&(uid=%u)(objectClass=posixAccount))"
  
  <Directory /home/*>
          DAV on
          Options Indexes FollowSymLinks Includes MultiViews
          Authtype basic
          AuthName "YOUHOSTSTANZA"
          AuthBasicProvider ldap
          AuthzLDAPAuthoritative off
          AuthLDAPURL "ldap://localhost"
          AuthLDAPURL "ldap://localhost:389/ou=People,dc=DOMAIN,dc=com?uid"
          <Limit GET PUT PATCH PROPPATCH MKCOL COPY MOVE LOCK UNLOCK POST OPTIONS PROPFIND>
                  Require valid-user
                  Order allow,deny
                  Allow from all
          </Limit>
  
  </Directory>
  

• To make sure that apache/php can read/write in all these folders add the user that apache runs under (www-data by default) has permissions by modifying the ACLs for these dir's like :

  setfacl -m user:www-data:rwx
  

• If you're filesystem/kernel doesn't allow ACLs you can add www-data to the group your users are in and set all the permissions to 0664 (files) and 0775 (for dir's).

This probably needs some fiddling to get PHP stuff to create new files with the right permissions, maybe even changing the group apache runs under (again, by default www-data) to the group your users are in. LDAPUserDir is noy by default installed on Debian, so you have to install it.