up vote 1 down vote favorite
share [g+] share [fb]

I have created a user and a group named the same (lighttpd:lighttpd)

Now I have to start the lighy server with these user:group... ok

Now, I have added a website (vhost) to run with lighy, it works well, but I have a question about permissions. For the vhost I've created another user and then I added it to lighttpd group.

mywebsite:lighttpd

Now, if I create other vhosts I will create new users, but if they have the same group each domain can view the files inside the other vhosts, so what can I do to block this?

Because if I change the permission on each vhost to allow only the owner(600) to see the files...I think I will have a problem with lighttpd (it can't read the page).

If i use 640 also the other vshots owners can view all the files because they have the same group.

Could you tell me the best manner to set permissions?

link|improve this question
feedback

migrated from stackoverflow.com Apr 23 '11 at 22:11

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 0 down vote

This seems to work:

  • create separate user/group for each of your sites, e.g. site1:site1
  • chown each site to this very user and group
  • set directory permissions to rwxr-x---, and rw-r----- for files
  • run lighttpd under e.g. www-data:www-data user/group
  • add your site groups as www-data user's supplementary groups

The last step allows for www-data user (and thus the lighttpd process) to access files belonging to your sites. On the other hand, user e.g. site1 can't access other sites - that's what you want, right?

Keep in mind, that users can still access files belonging to other sites using e.g. php scripts - as lighttpd can access any of the vhost files, so can FastCGI php script spawned by lighttpd.

link|improve this answer
ok, only two questions: 1. how to "add your site groups as www-data user's supplementary groups" ? could you give me and example?...i would know if i understood you 2. how can I block php scripts to read other vhosts files? THANKS – Damiano Apr 23 '11 at 9:29
You can use adduser <login> <group> to add the user to a group (or, in other words, add the group to the list of user's supplementary groups). Alternatively, you can manually edit /etc/group/ file (see man 5 group), but I strongly advise to use adduser. The second issue is much more difficult - php interpreter runs with the same set of permissions as the webserver. – CodePainters Apr 23 '11 at 9:54
(submitted previous comment truncated by mistake) The second issue is much more difficult - php interpreter runs with the same set of permissions as the webserver, effective it can access every served file. To overcome this you need to manually manage separate FastCGI process for each of the sites, but I never tried such a setup myself with lighttpd. – CodePainters Apr 23 '11 at 10:01
feedback

Your Answer

 
or
required, but never shown
discard