Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to allow web access to files without allowing other system users access to the files for the website.

I have owner:group as

bob:bob

Then I did:

usermod -a -G bob httpd

To add http to the user group.

File permissions on root folder are:

drwxr-xr--

But I cannot access the site from the internet anymore. The web server should be able to access the folder with the above permissions.

If I add o+x permission, it works immediately.

error log says:

[Tue May 01 17:25:20 2012] [crit] [client xxx.xx.xxx.xx] (13)Permission denied:
/var/www/bob/.htaccess pcfg_openfile: unable to check htaccess file, ensure it i
s readable

Any help would be greatly appreciated.

share|improve this question
    
Is the owner/group present in your httpd.conf file? They belong under the server.username and server.groupname settings, respectively. Also, you might need to change the owner of the root directory (as well as all files and subdirectories) to bob:bob with chown. –  Breakthrough May 1 '12 at 22:40
    
If httpd had access to the /var/www/bob dir before, then I don't think I need to worry about permissions on /var/www, right? In httpd.conf it is set to run as user:group apache:apache. But if it is also part of group bob shouldn't it have access to the dir? –  Buttle Butkus May 1 '12 at 22:52
    
It depens what MPM Apache is set to run with. Are you certain that processes to that folder run as apache:apache? It could be that for security the Apache config may be set to run as a different user. –  Eli Sand May 1 '12 at 22:58
    
Thanks for your help. I don't know what MPM it's running with but changing the group in httpd.conf to "bob" did give apache access to the folder. I'm not sure, though, why the filesystem wouldn't give access to the folder to a user that's supposed to be in the group. Perhaps the MPM overrides that setting and defines apache as belonging ONLY to the group specified in httpd.conf, and not to any other group? –  Buttle Butkus May 1 '12 at 23:25

1 Answer 1

If you have SELinux enabled, it could cause these issues. Checking /etc/selinux/config will tell you if it is. If so, then the proper contexts would need to be applied to the files apache is trying to access.

Changing the user in httpd.conf should be the last thing to do, typically you want httpd running a low-number service user, such as apache itself.

ls -lZ /var/www 

would show the contexts. sestatus will let you know the status of SELinux on your system. Apache is definitely a 'Targeted' app. checking the SELinux logs will also show the access violation.

By the way, disabling SELinux is not the way to go.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.