I'm trying to learn about permissions on linux webserver with apache.

Some clues to the system:
The server I have to play around with is Fedora based. Apache runs as apache:apache. To allow for e.g. php to write to a file the file needs to be chmod 777. 755 is not sufficiant.

What I'm wondering is basically how set up permissions like they should be on e.g. a "shared web host".

My main problem is that if I set a permission so that one user cannot access anothers home folder, then apache can't read from the public_html folder either.

To keep the users out I need to set chmod 700. But to let apache to read I need to have at least execute on world, so a 701 basically works, but won't let some users in.

So I'm really stuck on what to do. Have been concidering adding the apache user to the frous grours below to avoid having to add the world execute flag, but is that a bad thing? Should it be the other way around, the users in the groups below should also be in the apache group?

I was aiming at having 4 groups:

1. webapp
same as dev_int, but is the only one that can go inside the webapp/live folder to e.g. do an update from the repo.

2. dev_int
can read,write and execute everything in the "web root", including the two below, but nothing outside of the web root

3. dev_ext
can read write and execute in all client folders, but cannot access anything outside of the webapp root

4. clients
Basic ftp accounts. Has a home folder with a public_html, but cannot access any other home folders

An example of folder structure:

  • webroot    no users in the aforementioned groups can go outside of here
    • some_project    :dev_int only
    • webapp
      • live    :webapp only
      • staging    :dev_int and :dev_ext
      • clients    :dev_int and :dev_ext
        • client_1    :dev_int, :dev_ext and client1:clients
          • public_html
    • dev
      • developer_1    developer_1:dev_int OR :dev_ext
        • public_html

I would recommend looking at the two following options:

  1. Using a multiprocessing module for Apache (such as mpm-itk, that allows you to assing a specific UID and GID for every VHost. This could allow you to run Apache with needed privileges for each directory, and would increase security a bit, since Apache processes would run with narrower file system access.

  2. Using file system Access Control Lists (some information can be found e.g. in RHEL's documentation). This is a nice solution, because all users can preserve their privileges (and be isolated from other users), but you can give Apache rights to access their public_html directories.

You can also combine both solutions to configure a highly-isolated environment. I was happily using both approaches combined on a server with few hundred shell accounts and few separate VHosts for various web pages.


If you are using the yum installation of apache 2 then you can put the web page files anywhere. I use /var/www/html/DomainName.com to store each virtual domains files. I keep the info on the domains in a separate file instead of httpd.conf so I don't have to go through the whole file if I have to edit it.

The last line of my httpd.conf files is:

Include /etc/httpd/conf/domains.conf

Here is part of a script I use to create new doamins.

mkdir /var/www/html/$DOMAIN 
useradd -g apache  $USERNAME 
chown $USERNAME:    /var/www/html/$DOMAIN 
cd /home/$USERNAME 
ln -s /var/www/html/$DOMAIN www

echo "Adding httpd entry" 

echo "  " >>    /etc/httpd/conf/domains.conf 
echo "<VirtualHost *:80>" >>    /etc/httpd/conf/domains.conf
echo "      ServerAdmin webmaster@$DOMAIN" >> /etc/httpd/conf/domains.conf
echo "      DocumentRoot /var/www/html/$DOMAIN" >> /etc/httpd/conf/domains.conf
echo "      ServerName $DOMAIN" >> /etc/httpd/conf/domains.conf
echo "      ServerAlias www.$DOMAIN" >>   /etc/httpd/conf/domains.conf
echo "      ErrorLog logs/$DOMAIN-error_log" >>   /etc/httpd/conf/domains.conf
echo "      CustomLog logs/$DOMAIN-access_log common" >>   /etc/httpd/conf/domains.conf 
echo "</VirtualHost>" >> /etc/httpd/conf/domains.conf 

Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.