I have vhost1
,vhost2
under Apache.
Do I need to set /var/www/vhost1
's file owner to vhostuser1
,set /var/www/vhost2
's file owner to vhostuser2
.
Somebody said it's the necessary setting for security,suppose vhost1
was hacked,vhost2
will not be affected.
2 Answers
The main problem is not using dedicated user/group settings for each vhost DocumentRoot
; rather, the key point is that, by default, the httpd
process runs with the same permission for all your virtualhost. This means that a rogue php
script under vhost1
can read all vhost2
files.
A solution is to run each httpd
process under specific user permissions. This is done via the apache-mpm-itk
module. With this module, you can specify the user/group under which a single vhost will run. Combining that with restrictive permissions on the filesystem/DocumentRoot side, you can effectively prevent a compromised vhost to alter/spy other sites hosted on the same server.
Other, more heavy-weight approaches:
- run each
httpd
process under its chroot; - do extended use of Linux VPS / containers to create a dedicate instance for each site.
-
if I set
php_admin_value open_basedir
in apache conf,can rogue php readvhost2
file? Oct 1, 2018 at 13:14 -
-
@kittygirl
open_basedir
will protect you from php files only. Perl, python, cgi, etc. scripts remain a security concern. Oct 1, 2018 at 13:30 -
-
@kittygirl
chroot
done well is a complex task, whose explanation goes beyond what can be described here. I do not suggest to run a chrooted service unless you very well understand all the implications. Dec 29, 2018 at 16:34
No it's not mandatory, but it makes a LOT of sense if you deployed a server multiple users have access to. If you want to do this you would have to work with suexec, which executes cgi scripts as the respective user instead of the default www-data user.
This setup is mostly used if you have a webserver that is shared amongst multiple users and you want to keep them from accessing/manipulating each other's data (e.g. when they can run their own php scripts).
And also it increases security a bit since it does the same if one of your sites got hacked and malicious code was run on your site, at least your other sites will not be affected.
Downside is you have to keep track of all users/folders.
apache2
user needs write access under webroot). You'd be best-served by starting with Hardening Apache, IMHO.