Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a public Linux server running CentOS, Apache/PHP/MySQL. This server currently hosts multiple WordPress Blogs and Websites I am developing.

Currently, I have "userdir" enabled, and set up virtualhosts for each website. Under each user directory there is a htdocs file which is the root directory for each website.

  • Apache needs the necessary read/write permissions to the web files
  • The user needs to be able to read/write so I can upload the files from my IDE

For the permissions, I add the user "apache" to the user group. For example if I have a user called 'mark', I will run "usermod -a -G mark,apache apache", and then do "chmod -R 770 /home/mark/htdocs" to give Apache access to the web files. The problem with this is that Apache can read/write/execute on everything. I suppose this is bad for security because Apache should only be able to write and execute directories it needs to.

My question is, what is the optimal way to configure the server so:

  • Apache can read all files in the web root and write to directories it needs to (for uploads etc...)
  • The user account can have full control so that I can upload/modify files as I develop the websites
share|improve this question
    
For the permissions, I add the user "apache" to the user group.. Uhm. Apache has its own group so that if (or rather, when if you use an Internet facing website) it gets comprimised it can do little harm. If you add it to users you just disabled that security. (hint: leave it to its own user group our to user 'none'). You already seem aware that this is not the right way, but repeating that fact will do no harm. –  Hennes Jan 2 at 5:29
    

1 Answer 1

Does this help at all?

How to chown directory for multiple users?

Its a semi different question, but the answer should help.

share|improve this answer
    
Chowning directories to the right permissions is part of the answer, but without explaining why to do that and which groups and users to use it is not a good answer. Could you expand it a bit? –  Hennes Jan 2 at 5:37
    
He said he needs to be able to have apache to read all files in the webroot directories, thus a chown -R for it would help, but if he chowns the directory for apache, it will not simply work for the user. If he went back and chowned it for the user, it would not be chowned for apache. So if he groups the two users, then they both have the same access for modifying/writing to files. –  Travis Jan 3 at 6:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.