User rights setup, Tomcat and Apache users both need access to a directory

zeeshan12 · 11-10-2011, 04:22 AM

Hi,

I have a user rights issue that I need some help with and would appreciate any solutions/suggestions.

I have to run an app which has a few servlets that run through tomcat and some php files that are on apache web server. Code in all scripts and servlets need to access a directory on the system. The problem is, if the directory has been created by tomcat, apache cannot write into it and if apache creates a dir tomcat doesn't have write permission in it.

There is probably a very easy solution to this but I'm not very good with linux. I am running an enterprise linux 5 box.

bathory · 11-10-2011, 04:57 AM

Hi,

The easiest way to do this, is to use the same user for both servers. I.e. find the user that apache runs as (usually www-data or apache depending on distro) and use that same user to start tomcat:

Code:

su www-data -c "/path/to/tomcat/bin/startup.sh"

Regards

jhwilliams · 11-10-2011, 04:57 AM

Put your apache and tomcat users into a common group, e.g. webguys.

Code:

usermod -a -G apache webguys
usermod -a -G tomcat webguys

Now make sure the respective users own their directory hierarchies, but can share via group.

Code:

chown -R apache:webguys /var/www
chown -R tomcat:webguys /var/lib/tomcat

Finally, chmod g+s on those dirs, so that group owner propagates to new files:

Code:

chmod g+s /var/www
chmod g+s /var/lib/tomcat

Optionally, set umask to 0664 someplace.

zeeshan12 · 11-10-2011, 05:30 AM

Thanks guys i will try that shortly and get back to you. I have previously tried adding tomcat to apache's group and change group of the main directory to apache. That way both had write access to the main directory but problem still persisted when a directory was created within that main dir by any of the users. The user that created the dir only had write permissions in it.

Regards

zeeshan12 · 11-10-2011, 05:34 AM

Quote:

Originally Posted by bathory

Hi,

The easiest way to do this, is to use the same user for both servers. I.e. find the user that apache runs as (usually www-data or apache depending on distro) and use that same user to start tomcat:

Code:

su www-data -c "/path/to/tomcat/bin/startup.sh"

Regards

I think running tomcat with apache's user might stop tomcat from accessing its own resources like log files etc. I will have to go and change each of tomcat's resource and set flexible permissions on them?

bathory · 11-10-2011, 05:35 AM

Quote:

I think running tomcat with apache's user might stop tomcat from accessing its own resources like log files etc. I will have to go and change each of tomcat's resource and set flexible permissions on them?

You're right. You need:

Code:

chown -R apache:apache /path/to/tomcat/

zeeshan12 · 11-10-2011, 05:38 AM

Quote:

Originally Posted by jhwilliams

Put your apache and tomcat users into a common group, e.g. webguys.

Code:

usermod -a -G apache webguys
usermod -a -G tomcat webguys

Now make sure the respective users own their directory hierarchies, but can share via group.

Code:

chown -R apache:webguys /var/www
chown -R tomcat:webguys /var/lib/tomcat

Finally, chmod g+s on those dirs, so that group owner propagates to new files:

Code:

chmod g+s /var/www
chmod g+s /var/lib/tomcat

Optionally, set umask to 0664 someplace.

That's to setup a new group and make sure that servlets and php scripts both run through that group (since users are added in that group).

what permission would i need to give to that directory that they both are accessing and writing into? Should i just change its group to webguys and leave the user to either tomcat or apache ? and what chmod would i need on it?

Thanks