I'm trying to configure my apache server on Debian 7. I have the following configuration: Every linux user has a folder in the /home directory. In their user directory, they have a www dirctory. So, their apache root directory is /home/bob/www/ My question is: what permission should I set for the www directory? So far, I've added the www-data user to each group of each user (say, if I have users bob and pete, www-data is a member of both groups bob and pete), and set their root directory permissions to 774. Is this the right way to do it?

Thanks in advance


First, there's a major consideration which affects the ways to approach the necessary setup:

  1. Apache will only serve static content from these places (this means no "dynamic" sites which allow uploading and no CMS-like sites which write their own log files or temporary files etc).

    In this case read-only access for Apache is OK.

  2. The users want to run dynamic sites (CGI and more advanced stuff).

    In this case you have to make some places in the hierarchies writable by Apache.

Now there are the possibilities:

  • Just make the necessary hierarchies readable (and traversable — for directories) for everyone.

    Obviously, this only works for read-only (and hence static) content.

    In this case just make sure the directories to be served have a=rx permissions and files in them have a=r permissions — that is, users other than those belonging to the owning user and group are allowed to traverse the directories and read files in them.

    Note that this will make the "exported" stuff readable for really everyone, not just Apache, and this might pose a security problem.

  • As the Apache wiki suggests, create a separate group, make Apache run with its GID and make this group have appropriate access (R/O or R/W where applicable) to the resources.

    As a matter of fact, Debian already has this group, www-data, so you might just add your users to that group. An obvious downside is that they will automatically gain access to other resources owned by the www-data group.

  • Use privilege separation using mpm-itk or some other approach. This allows you to serve per-user stuff with per-user privileges (the apache's manager process runs as root but the worker processes it spawns run with credentials of the specified users.

    I'm not sure this would play well with mod_userdir though.

  • Consider using POSIX ACLs to implement a finer-grained access controls to these directories.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.