LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 07-10-2006, 08:31 PM   #1
Wordan
Member
 
Registered: Aug 2003
Distribution: Debian
Posts: 53

Rep: Reputation: 15
Apache user directories permissions


I have been trying to find out about security in users public_html directories. I am running Debian 3.1 as a test web host. I use my /home/oliver/public_html directory for my php scripts etc. For them to run, everybody needs to have at least read permitions, and I am guessing 'write' too if I want my php scripts to be able to write to that folder. Then what is stopping other users on the system from reading and editing my files? If they can, how can I stop them from doing so?
 
Old 07-11-2006, 01:14 PM   #2
pljvaldez
Guru
 
Registered: Dec 2005
Location: Somewhere on the String
Distribution: Debian Squeeze (x86)
Posts: 6,092

Rep: Reputation: 269Reputation: 269Reputation: 269
I would say that you should probably put the php scripts in a separate directory if possible. I don't remember if you can use symbolic links to point them. If not, you can mount that folder on loopback for each user and point all users to the same directory. Your fstab line would look something like this if I remember correctly
Code:
/var/www/html/phpdir   /home/oliver/public_html/phpdir    ext3   defaults,rw,loop   0   0
/var/www/html/phpdir   /home/joeblow/public_html/phpdir    ext3   defaults,loop   0   0
Then make sure everyone is a member of that group and give rw permissiont to /var/www/html/phpdir.
 
Old 07-11-2006, 06:17 PM   #3
spooon
Senior Member
 
Registered: Aug 2005
Posts: 1,755

Rep: Reputation: 48
I don't know about PHPs, but I know for CGIs there is suEXEC which runs them under the user's UID, so it can do exactly the things the user can do.
 
Old 07-14-2006, 09:30 AM   #4
Wordan
Member
 
Registered: Aug 2003
Distribution: Debian
Posts: 53

Original Poster
Rep: Reputation: 15
Thanks

I don't understand the fstab file, I'll have to look into that. But if I understand what you're suggesting, everybody will still be able to edit each others scripts?

I read about FastCGI with suEXEC which sounds good but setting that up is beyond my abilities, and I am wondering how ISP's do it. Where my ISP seams to have a folder for each user under /home and we can run PHP scrips. I always though they used mod_php for apache. I used to think mod_php or mod_userdir had some security features built in for this, but I can't seam to find them

Last edited by Wordan; 07-14-2006 at 09:34 AM.
 
Old 07-14-2006, 10:28 AM   #5
gizza23
Member
 
Registered: Jun 2005
Location: Chicago, IL, USA
Distribution: Fedora Core, CentOS
Posts: 188

Rep: Reputation: 31
Sounds complicated. Setting up PHP scripts for all of the users to see will be quite difficult given the fact that a user's folder is supposed to be accessible only to her and root. Try to placing the script files somewhere that is globally accessible by users like /scripts and make sure that the intended users and apache has read and/or write access to it.

How does that sound?
 
Old 07-14-2006, 12:19 PM   #6
Wordan
Member
 
Registered: Aug 2003
Distribution: Debian
Posts: 53

Original Poster
Rep: Reputation: 15
Thinking of a multiuser server, where everybody has a public_html directory and can host php scripts.

For example: A user creates a php script that needs to write and edit files (under their public_html directory)

That directory and the files in it would need read and writable permitions so the webserver can see and edit them. You'd acheive that by setting the 'other' permitions to writable, or 'group' if the files belongs to a group the webserver belongs to.

Either way everybody else can now write and modify these files one way or another, either through the shell or making a php script that runs with the webservers permitions. I think?

Also, what about scripts or files which have MySQL database password in them etc. Now they can be read by everyone.

The only way I can see this working is if the webserver restricts php scripts from doing things outside of its owner's directory, and each user gives permitions for their files only to the webserver for their files using a group the webserver belongs to.

Not sure where I'm going with this, I'm just trying to understand how it works, and how I'd set up that multiuser server.

Last edited by Wordan; 07-14-2006 at 12:20 PM.
 
Old 07-14-2006, 01:15 PM   #7
gizza23
Member
 
Registered: Jun 2005
Location: Chicago, IL, USA
Distribution: Fedora Core, CentOS
Posts: 188

Rep: Reputation: 31
Quote:
Thinking of a multiuser server, where everybody has a public_html directory and can host php scripts.
I'm assuming that's already completed.
Quote:
For example: A user creates a php script that needs to write and edit files (under their public_html directory)
I'm assuming that evey administrator who sets up Apache can manage that
Quote:
That directory and the files in it would need read and writable permitions so the webserver can see and edit them.
1.Apache has read capabilities on the /home/*/public_html/ folder
2.Write permissions for apache can be acheived by making the apache group the owning group for the file and giving write access to that folder.
[code]
chown -R ug+rwx /home/*/public_html/scripts/
Quote:
You'd acheive that by setting the 'other' permitions to writable, or 'group' if the files belongs to a group the webserver belongs to.
I don't know what this means.
[QUOTE]
Quote:
Either way everybody else can now write and modify these files one way or another, either through the shell or making a php script that runs with the webservers permitions. I think?
If you aren't sure then you should make sure. You are the administrator so know your territory.
Quote:
Also, what about scripts or files which have MySQL database password in them etc. Now they can be read by everyone.
That's true.
Quote:
The only way I can see this working is if the webserver restricts php scripts from doing things outside of its owner's directory, and each user gives permitions for their files only to the webserver for their files using a group the webserver belongs to.
1.If the script wasnt written to make files outside of the /home/*/public_html folder then it won't. If it tries then it can only attempt to write where Apache has write access.
2.The latter occurs by default.
Quote:
Not sure where I'm going with this, I'm just trying to understand how it works, and how I'd set up that multiuser server.
If you don't know where you are going how can you ask for help and effectively participate in the solution finding process? There are plenty of manuals available at libraries and bookstores. Pick one up!
 
Old 07-14-2006, 01:49 PM   #8
Wordan
Member
 
Registered: Aug 2003
Distribution: Debian
Posts: 53

Original Poster
Rep: Reputation: 15
Not sure what you're getting with all you're comments to each of my sentences... I think you read my post out of context... I was just elaborating on my first post because I wasn't sure I made sence. Besides this is a 'discussion' forum and if you're not interested in what I am trying to discuss or figure out, then don't bother writing in this thread.

I want to know how to run php scripts in users directories with out users being able to interfear with each others files.

at the moment, on debian sarge, my public_html files need to be world readable
 
Old 07-14-2006, 02:40 PM   #9
gizza23
Member
 
Registered: Jun 2005
Location: Chicago, IL, USA
Distribution: Fedora Core, CentOS
Posts: 188

Rep: Reputation: 31
Why the defense? I broke your comment down because I coudln't understand what was what was being requested in the clarification. If one wants to discuss but doesn't understand one's topic then there's a major problem that needs to be addresses. That was the form in which I addressed it.

I also apologize for posting to your "discussion" forum. I didn't mean to walk next to the tree you pissed on.

Have fun with your Apache setup. I'm sure that your foundation in Apache will benefit from "discussion."
 
Old 07-14-2006, 03:42 PM   #10
Wordan
Member
 
Registered: Aug 2003
Distribution: Debian
Posts: 53

Original Poster
Rep: Reputation: 15
Because it looked like you attacked my post. What's wrong with a bit of discussion anyway? I'm not discussing my foundation in Apache.

Last edited by Wordan; 07-14-2006 at 03:51 PM.
 
  


Reply

Tags
apache, debian, publichtml, security


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Apache User Directories problem in Fedora 5 Core upgrade SparceMatrix Linux - Security 6 04-25-2006 10:15 PM
Multiple website on Apache with User Directories Mr_Oz Red Hat 2 01-16-2006 07:20 AM
Creating user directories in Apache root robojerk Linux - Networking 1 09-21-2004 12:34 PM
Per-user directories with password protection (apache) gwroy20 Linux - Software 1 04-27-2004 12:48 AM
apache 2.0 user cgi-bin directories JHuizingh Linux - Software 3 03-19-2003 03:58 PM


All times are GMT -5. The time now is 12:52 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration