Have to set different file owner to differenct apache vhost?

Question

I have vhost1,vhost2 under Apache.
Do I need to set /var/www/vhost1's file owner to vhostuser1,set /var/www/vhost2's file owner to vhostuser2.
Somebody said it's the necessary setting for security,suppose vhost1was hacked,vhost2 will not be affected.

Answer 1

The main problem is not using dedicated user/group settings for each vhost DocumentRoot; rather, the key point is that, by default, the httpd process runs with the same permission for all your virtualhost. This means that a rogue php script under vhost1 can read all vhost2 files.

A solution is to run each httpd process under specific user permissions. This is done via the apache-mpm-itk module. With this module, you can specify the user/group under which a single vhost will run. Combining that with restrictive permissions on the filesystem/DocumentRoot side, you can effectively prevent a compromised vhost to alter/spy other sites hosted on the same server.

Other, more heavy-weight approaches:

• run each httpd process under its chroot;
• do extended use of Linux VPS / containers to create a dedicate instance for each site.

Answer 2

No it's not mandatory, but it makes a LOT of sense if you deployed a server multiple users have access to. If you want to do this you would have to work with suexec, which executes cgi scripts as the respective user instead of the default www-data user.

This setup is mostly used if you have a webserver that is shared amongst multiple users and you want to keep them from accessing/manipulating each other's data (e.g. when they can run their own php scripts).

And also it increases security a bit since it does the same if one of your sites got hacked and malicious code was run on your site, at least your other sites will not be affected.

Downside is you have to keep track of all users/folders.