I'm having trouble with permissions and ownership on a fedora28 system with apache-2.4 and joomla-3.9. I'd like to be able to have only the minimal number of files necessary to be owned by apache and have an ssh/sftp user have access to read and write every file in the document root.
I'm trying to solve two problems:
- Provide ability for ssh/sftp users to write files within the document root
- Provide apache with only the minimal ability necessary to write/delete files, while not being restricted from reading
The problem is that creating files with 664 ownership causes many of the extensions like Akeeba Backup to complain that the files are too relaxed and insist it must be 644.
I've loaded mod_suexec and enabled it with "Suexec on" and configured SuexecUserGroup to the name of the ssh/sftp user and "apache":
SuexecUserGroup ftpuser apache
then changed the ownership of all files and directories to ftpuser.apache, but this only works when files are created or modified by the ftpuser.
I've then gone through and set ownership to a few specific files that apache needs read/write access to for normal operation.
#!/bin/bash PLACES=' administrator/backups administrator/components administrator/modules administrator/templates administrator/language administrator/cache cache components images images/banners images/stories language media modules templates tmp ' for i in $PLACES; do chown -R apache:apache $i; chmod g+w $i; done chmod g+w tmp components language language/en-GB logs modules administrator/components administrator/language \ administrator/language/en-GB
Even after configuring suexec in this way, apache can't delete files owned by ftpuser with permissions 644. Apache needs the ability to write to more than what's listed when doing upgrades or extension updates.
The problem is that the apache server is running as user apache, so any files that it writes would have to be owned by the apache user, assuming the permissions were 644 or 755.
I thought about using sgid here, changing permissions of all directories to 2775, so any files created by the apache user would maintain the apache group ownership and 664 permissions, but that doesn't help with security and keeping Akeeba Backup happy with the 644 permissions issue.
What do most service providers like SiteGround do? Do they just change ownership of everything to be the user running apache, then give all sftp users the same UID?
Is there any way around just changing ownership to apache.apache, adding the ssh/sftp user to the apache group, and setting everything sgid?