localhost 403 - How to set right permissions?

Question

My DocumentRoot is set to /var/workspace/www

drwxrwx--- 110 radek www-data 4096 Jul 11 11:34 www

Firstly i had 777 permissions on that folder (and all files inside), but i don't like it, because everyone can see it and change it.

As Apache runs under user www-data:www-data, i tried to set the group and permissions:

sudo chgrp www-data www -R
sudo chmod 770 www -R

After i done that, http://localhost started to show 403 - Forbidden. It just looks like apache is taken as "other" (from owner, group, other) in words of permissions.

What should i change (permissions, owners, whatever) to keep all files visible and changable only for me (user radek) and executable by apache?

As i can see, there's one Apache process running under root and many others under www-data.

radek@me:/$ ps -Af | grep apache
root     13165     1  0 11:37 ?        00:00:00 /usr/sbin/apache2 -k start
www-data 13173 13165  0 11:37 ?        00:00:00 /usr/sbin/apache2 -k start
www-data 13174 13165  0 11:37 ?        00:00:00 /usr/sbin/apache2 -k start
www-data 13175 13165  0 11:37 ?        00:00:00 /usr/sbin/apache2 -k start
www-data 13176 13165  0 11:37 ?        00:00:00 /usr/sbin/apache2 -k start
www-data 13177 13165  0 11:37 ?        00:00:00 /usr/sbin/apache2 -k start
www-data 13190 13165  0 11:37 ?        00:00:00 /usr/sbin/apache2 -k start
www-data 13194 13165  0 11:37 ?        00:00:00 /usr/sbin/apache2 -k start

Is the first process the reason of problems described above?

Answer 1

Apache (and many other daemons) start as root and then switch to another user. this is correct. user permissions 755 should be right (owner has read write and execute.. or 4 2 and 1... group has read and execute... and others have read and execute)

your 770 setting means

owner has read write execute. group has read write and execute. everyone else has nothing.

it will always issue a 403 under those settings.

if you want a specific user to have read write access then you have to chown it to that user.