2

I want to allow web access to files without allowing other system users access to the files for the website.

I have owner:group as

bob:bob

Then I did:

usermod -a -G bob httpd

To add http to the user group.

File permissions on root folder are:

drwxr-xr--

But I cannot access the site from the internet anymore. The web server should be able to access the folder with the above permissions.

If I add o+x permission, it works immediately.

error log says:

[Tue May 01 17:25:20 2012] [crit] [client xxx.xx.xxx.xx] (13)Permission denied:
/var/www/bob/.htaccess pcfg_openfile: unable to check htaccess file, ensure it i
s readable

Any help would be greatly appreciated.

Improve this question
4
  • Is the owner/group present in your httpd.conf file? They belong under the server.username and server.groupname settings, respectively. Also, you might need to change the owner of the root directory (as well as all files and subdirectories) to bob:bob with chown.
    – Breakthrough
    Commented May 1, 2012 at 22:40
  • If httpd had access to the /var/www/bob dir before, then I don't think I need to worry about permissions on /var/www, right? In httpd.conf it is set to run as user:group apache:apache. But if it is also part of group bob shouldn't it have access to the dir?
    – Buttle Butkus
    Commented May 1, 2012 at 22:52
  • It depens what MPM Apache is set to run with. Are you certain that processes to that folder run as apache:apache? It could be that for security the Apache config may be set to run as a different user.
    – Eli Sand
    Commented May 1, 2012 at 22:58
  • Thanks for your help. I don't know what MPM it's running with but changing the group in httpd.conf to "bob" did give apache access to the folder. I'm not sure, though, why the filesystem wouldn't give access to the folder to a user that's supposed to be in the group. Perhaps the MPM overrides that setting and defines apache as belonging ONLY to the group specified in httpd.conf, and not to any other group?
    – Buttle Butkus
    Commented May 1, 2012 at 23:25

1 Answer 1

Reset to default
1

If you have SELinux enabled, it could cause these issues. Checking /etc/selinux/config will tell you if it is. If so, then the proper contexts would need to be applied to the files apache is trying to access.

Changing the user in httpd.conf should be the last thing to do, typically you want httpd running a low-number service user, such as apache itself.

ls -lZ /var/www

would show the contexts. sestatus will let you know the status of SELinux on your system. Apache is definitely a 'Targeted' app. checking the SELinux logs will also show the access violation.

By the way, disabling SELinux is not the way to go.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .