File/folder permissions and groups on Linux with Apache

Question

I'm trying to learn about permissions on linux webserver with apache.

Some clues to the system:
The server I have to play around with is Fedora based. Apache runs as apache:apache. To allow for e.g. php to write to a file the file needs to be chmod 777. 755 is not sufficiant.

What I'm wondering is basically how set up permissions like they should be on e.g. a "shared web host".

My main problem is that if I set a permission so that one user cannot access anothers home folder, then apache can't read from the public_html folder either.

To keep the users out I need to set chmod 700. But to let apache to read I need to have at least execute on world, so a 701 basically works, but won't let some users in.

So I'm really stuck on what to do. Have been concidering adding the apache user to the frous grours below to avoid having to add the world execute flag, but is that a bad thing? Should it be the other way around, the users in the groups below should also be in the apache group?

I was aiming at having 4 groups:

1. webapp
same as dev_int, but is the only one that can go inside the webapp/live folder to e.g. do an update from the repo.

2. dev_int
can read,write and execute everything in the "web root", including the two below, but nothing outside of the web root

3. dev_ext
can read write and execute in all client folders, but cannot access anything outside of the webapp root

4. clients
Basic ftp accounts. Has a home folder with a public_html, but cannot access any other home folders

An example of folder structure:

• webroot    no users in the aforementioned groups can go outside of here
  • some_project    :dev_int only
  • webapp
    • live    :webapp only
    • staging    :dev_int and :dev_ext
    • clients    :dev_int and :dev_ext
      • client_1    :dev_int, :dev_ext and client1:clients
        • public_html
  • dev
    • developer_1    developer_1:dev_int OR :dev_ext
      • public_html

Answer 1

If you are using the yum installation of apache 2 then you can put the web page files anywhere. I use /var/www/html/DomainName.com to store each virtual domains files. I keep the info on the domains in a separate file instead of httpd.conf so I don't have to gop through the whole file if I have to edit it.

The last line of my httpd.conf files is:

Include /etc/httpd/conf/domains.conf

Here is part of a script I use to create new doamins.

DOMAIN=$1

USERNAME=$2

mkdir /var/www/html/$DOMAIN

useradd -g apache $USERNAME

chown $USERNAME: /var/www/html/$DOMAIN

cd /home/$USERNAME

ln -s /var/www/html/$DOMAIN www echo " Adding httpd entry"

echo " " >> /etc/httpd/conf/domains.conf

echo "" >> /etc/httpd/conf/domains.conf

echo " ServerAdmin webmaster@$DOMAIN" >> /etc/httpd/conf/domains.conf

echo " DocumentRoot /var/www/html/$DOMAIN" >> /etc/httpd/conf/domains.conf

echo " ServerName $DOMAIN" >> /etc/httpd/conf/domains.conf

echo " ServerAlias www.$DOMAIN" >> /etc/httpd/conf/domains.conf

echo " ErrorLog logs/$DOMAIN-error_log" >> /etc/httpd/conf/domains.conf

echo " CustomLog logs/$DOMAIN-access_log common" >> /etc/httpd/conf/domains.conf echo "" >> /etc/httpd/conf/domains.conf

Hope this helps.