[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: How to get Apache to write files as group writable?



Jay Paulson wrote:
I also found that in the /etc/httpd/conf/httpd.conf file you can change the group apache runs as from apache to www (or whatever group you want). Then start up /etc/init.d/httpd as root for it to take effect (at least that what it says in the httpd.conf file).
My question now is which is the better way?
I'll have to try both ways. :)


The two things are completely different.

Changing the group in /etc/httpd/conf/httpd.conf just changes group that apache runs as. It will not affect the permission bits of files created by the web server in any way, only the GID of those files (if you're using the SGID bit on a directory, the GID of newly-created files will be the same as the directory, otherwise, the GID of the running process).

Be careful about the UID/GID you run httpd as, and the UID/GID/permissions of the files on your system. Security-wise, the httpd should run with just enough permissions to be able to function correctly, i.e. it should not be able to write to most files, just read the files it's serving and write to files/directories that you want to be able to upload to.

Changing the umask to 002 will mean that newly-created files will have write permissions set for the UID and GID of the file.

Paul.


Thanks for the explanation it makes perfect sense to me and the security issue you bring up is very serious.

The reason why I need apache to have write permissions set for the UID and the GID is that I have other users who log in locally and will need access to modify those files that are uploaded via apache. Hence the reason why my local users and apache are all in the 'www' group. This, as you pointed out, isn't best for security, which really does concern me.

Is there a more secure way of setting this up so that files that are created by apache are writable by the group and the local users without compromising the security of the rest of the files on the web root through apache?

Try this:

- create a new group specifically to cover the area that httpd and your local users should be able to write to, and add user apache and your local users to that group.

- change the GID of that directory and everything underneath it to the new group.

- set the SGID bit on that directory and all directories underneath it so that new files created there have the correct group ID.

- change httpd.conf back to the default of running as user and group apache.

- make sure that your web root is not owned by user apache so that it cannot write to it.

- start httpd with a umask of 002 so that it sets the group write bit on any files it creates.

Paul.


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]