1

I'm having trouble with permissions and ownership on a fedora28 system with apache-2.4 and joomla-3.9. I'd like to be able to have only the minimal number of files necessary to be owned by apache and have an ssh/sftp user have access to read and write every file in the document root.

I'm trying to solve two problems:

  • Provide ability for ssh/sftp users to write files within the document root
  • Provide apache with only the minimal ability necessary to write/delete files, while not being restricted from reading

The problem is that creating files with 664 ownership causes many of the extensions like Akeeba Backup to complain that the files are too relaxed and insist it must be 644.

I've loaded mod_suexec and enabled it with "Suexec on" and configured SuexecUserGroup to the name of the ssh/sftp user and "apache":

SuexecUserGroup ftpuser apache

then changed the ownership of all files and directories to ftpuser.apache, but this only works when files are created or modified by the ftpuser.

I've then gone through and set ownership to a few specific files that apache needs read/write access to for normal operation.

#!/bin/bash

PLACES='
administrator/backups
administrator/components
administrator/modules
administrator/templates
administrator/language
administrator/cache
cache
components
images
images/banners
images/stories
language
media
modules
templates
tmp
'
for i in $PLACES; do chown -R apache:apache $i; chmod g+w $i; done

chmod g+w tmp components language language/en-GB logs modules 
administrator/components administrator/language \
    administrator/language/en-GB

Even after configuring suexec in this way, apache can't delete files owned by ftpuser with permissions 644. Apache needs the ability to write to more than what's listed when doing upgrades or extension updates.

The problem is that the apache server is running as user apache, so any files that it writes would have to be owned by the apache user, assuming the permissions were 644 or 755.

I thought about using sgid here, changing permissions of all directories to 2775, so any files created by the apache user would maintain the apache group ownership and 664 permissions, but that doesn't help with security and keeping Akeeba Backup happy with the 644 permissions issue.

What do most service providers like SiteGround do? Do they just change ownership of everything to be the user running apache, then give all sftp users the same UID?

Is there any way around just changing ownership to apache.apache, adding the ssh/sftp user to the apache group, and setting everything sgid?

  • No one has any further ideas here? Should I be posting in a security group instead? Privilege escalation attack, anyone? – Alex Regan Jan 12 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.