I've installed apache2-mpm-itk on a new VPS to run multiple sites on the same server with isolation following the directions here: http://www.webtatic.com/packages/httpd-itk/. I want to lock it down as much as possible but also need to be able to manage the files on each vhost as each vhost-user.

He recommends to set the webroot folder's owner and permissions like this:

chown owner-user:vhost-group /path/to/webroot
chmod o-rwx /path/to/webroot

ls -ald /path/to/webroot
# drwxr-x--- 20 owner-user vhost-group 4096 Apr  5 19:38 /path/to/webroot

On my server I have root, a non-root user that is a sudoer, and the vhost-user for this site (who does not have sudo privileges).

Setting up the webroot with 755 permissions and then setting the owner to owner-user (I set it to my non-root sudoer user) means I can't modify the files and directories within the webroot as the vhost-user. (no group write permissions on the web root). The only thing I can think to do is give the vhost-user sudo privileges but that doesn't seem secure.

The article says that the owner-user is the owner of the webroot because:

The reason I didn’t change the user of the directory to vhost-user is that it would give the httpd process write access, which you still should take care of, as if there are vulnerabilities in the user’s code, the files could be hacked.

How can I set permissions/users etc. to be secure but still allow the vhost-user to manage their own home directory?

Also, within the webroot, how should I set the permissions of my PHP files and directories to keep them isolated from other users/groups on the same server?


First a remark. You should have used

chown -R owner-user:vhost-group /path/to/webroot
chmod -R 640 /path/to/webroot
chmod -R u+X,g+X /path/to/webroot

if /path/to/webroot didn't happen to be empty.

The kind of stupid but unfortunately correct answer to your question is simply: Sorry, your question does not make sense. Why?

You define (i.e. accept the definition of that web site) "secure" as "no write access for user X". And now you want both to be "secure" and to have write access for that user. That is obviously impossible.

Your question can be answered only if you give a both precise and usable definition of "secure" in this case.

My first proposal would be to seperate the users. Why shall vhost-user manage the files and not an additional vhost-manage account? Does it make sense to have this requirement?

The next point is: Not having write access to a directory just prevents you from deleting and creating files but not from modifying those files. You just need write access to those files (not necessarily all files).

Creating and deleting files via a sudo script doesn't look like a security risk to me; especially then if this is not done as root but as a user whose only purpose is the ownership of this directory tree.

| improve this answer | |
  • webroot was empty when I was setting it up, but thanks for the tip. Obviously I don't have much experience with this. I'm basically trying to set up my VPS like it's a shared host, but I own all the sites. So I "trust" the owner of each site, since it's me, but I still don't want the sites to be able to access each other. Having a vhost-manage account would make sense. In that case, how would I configure the permissions so vhost-manage can manage the files. Would they be a sudoer? Would that be a risk? (no scripts just giving the user sudo access) – jjeaton May 8 '13 at 20:44
  • @jjeaton You don't need sudo in that case (at least I don't know what for). You do chown -R manage-user-1:vhost-group /path/to/webroot_1 for all your web roots. If you want to be sure they cannot even read the others' content (if Apache got cracked bot nothing else) then you define a seperate vhost-group for each web root. You keep the permissions as they are (or should be) according to both that web page and what I wrote above: 640 for files, 750 for directories. – Hauke Laging May 8 '13 at 20:56
  • ok so vhost-manage can just be my owner-user from that tutorial I linked? I created a new vhost-user for each site and put the webroot within their home directory. Should I also have a vhost-manage for each site and have the webroot within their directory instead? – jjeaton May 8 '13 at 21:33
  • @jjeaton With manage-user-1 I wanted to express that you need one for each site. And without seperate vhost-user accounts it wouldn't make any sense to use MPM-ITK at all. If you want to put the web root in a home directory then this should be the $HOME of the respective vhost-manage account (because you can delete / replace anything in your $HOME). vhost-user-x must be able to access the web root in vhost-manage-x's $HOME though. You can do this either by ACL or by creating a group for each vhost-user-x vhost-manage-x pair. – Hauke Laging May 8 '13 at 21:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.