Permission denied while uploading files in htdocs because owner and group is apache

unclesamcrazy · 09-05-2014, 06:21 AM

I have a ftp user which is created to upload files in apache's htdocs directory (/var/www/html)
There are some project directories in /var/www/html which needs owner and group both 'apache' to work correctly but if directory's owner and group is 'apache', ftp user is not able to upload files in those directories and if I change the owner and group of the project directory to ftp user's, the functionality does not work.

What should I do to solve this problem.
Please help.

--Thanks & Kind Regards
Sam

keefaz · 09-05-2014, 07:04 AM

Make ftp user a member of apache group? Set write permission for others in the upload directories?

Or maybe use apache module mod_ruid2 and set owner of /var/www/html to any user you want in httpd config and in filesystem

zhjim · 09-05-2014, 07:13 AM

I like keefaz idea with the ftp user inside the apache group. Else you could check into ACL and have the ftp group or user write permission to the directory.

jpollard · 09-05-2014, 08:17 AM

What distribution is this?

Those with SELinux enabled also need to have the proper security labels applied to the file - and that is likely not done by ftp.

unclesamcrazy · 09-17-2014, 05:31 AM

Sorry for Late Answer.
It is CentOS 6.5. vsftpd as a ftp daemon installed on it. httpd is installed on it.
No, SELinux is not installed on it. May be it was installed before but now there is no SELinux.

I think the owner and group of htdocs directory(/var/www/html) should be apache.

This is the line in /etc/passwd

Code:

apache:x:48:48:Apache:/var/www:/bin/bash
user:x:1001:501:FTP USER user:/home/www/html:/bin/bash

This is the line in /etc/group

Code:

user:x:501:apache
apache:x:48:user

I have assigned group user to apache as well as group apache to user, but still not able to upload files into htdocs(owner & group apache) when logged in as user from ftp.

jpollard · 09-17-2014, 06:17 AM

I don't think that would change anything.

Apache doesn't run with multiple groups. The group the process runs under is specified in the apache configuration file (48).

All the group file does is give the USER access to both gids.

Now if the apache user logged in, then that user would have access to both.

You also don't address what the users UMASK is for ftp. Normally (for security) it is set to 077, which would prevent group or world access unless the ftp user changes the access mode.

maples · 09-17-2014, 08:32 AM

Did you add the ftp user to the apache group? Then make sure that the group has write access to the files.

EDIT: On my Debian system, I think that my /var/www/ was owned by root... did you double-check the ownership of those files?

Germany_chris · 09-17-2014, 08:42 AM

Quote:

Originally Posted by unclesamcrazy

Sorry for Late Answer.
It is CentOS 6.5. vsftpd as a ftp daemon installed on it. httpd is installed on it.
No, SELinux is not installed on it. May be it was installed before but now there is no SELinux.

I think the owner and group of htdocs directory(/var/www/html) should be apache.

This is the line in /etc/passwd

Code:

apache:x:48:48:Apache:/var/www:/bin/bash
user:x:1001:501:FTP USER user:/home/www/html:/bin/bash

This is the line in /etc/group

Code:

user:x:501:apache
apache:x:48:user

I have assigned group user to apache as well as group apache to user, but still not able to upload files into htdocs(owner & group apache) when logged in as user from ftp.

Unless you uninstalled SELinux or turned it off it's enabled by default.