Re: How to get Apache to write files as group writable?

From: Jay Paulson (jpaulson_at_sedl.org)
Date: 09/15/05

  • Next message: Mirco SCara: "fedora 4, Gnome 2.12 GDM problem;" 
    Date: Thu, 15 Sep 2005 10:31:51 -0500
To: For users of Fedora Core releases <fedora-list@redhat.com>

    >> I also found that in the /etc/httpd/conf/httpd.conf file you can
    >> change the group apache runs as from apache to www (or whatever group
    >> you want). Then start up /etc/init.d/httpd as root for it to take
    >> effect (at least that what it says in the httpd.conf file).
    >> My question now is which is the better way?
    >> I'll have to try both ways. :)
    >
    > The two things are completely different.
    >
    > Changing the group in /etc/httpd/conf/httpd.conf just changes group
    > that apache runs as. It will not affect the permission bits of files
    > created by the web server in any way, only the GID of those files (if
    > you're using the SGID bit on a directory, the GID of newly-created
    > files will be the same as the directory, otherwise, the GID of the
    > running process).
    >
    > Be careful about the UID/GID you run httpd as, and the
    > UID/GID/permissions of the files on your system. Security-wise, the
    > httpd should run with just enough permissions to be able to function
    > correctly, i.e. it should not be able to write to most files, just
    > read the files it's serving and write to files/directories that you
    > want to be able to upload to.
    >
    > Changing the umask to 002 will mean that newly-created files will have
    > write permissions set for the UID and GID of the file.
    >
    > Paul.

    Thanks for the explanation it makes perfect sense to me and the
    security issue you bring up is very serious.

    The reason why I need apache to have write permissions set for the UID
    and the GID is that I have other users who log in locally and will need
    access to modify those files that are uploaded via apache. Hence the
    reason why my local users and apache are all in the 'www' group. This,
    as you pointed out, isn't best for security, which really does concern
    me.

    Is there a more secure way of setting this up so that files that are
    created by apache are writable by the group and the local users without
    compromising the security of the rest of the files on the web root
    through apache?

    Thanks,
    jay 

    -- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
  • Next message: Mirco SCara: "fedora 4, Gnome 2.12 GDM problem;"

    Relevant Pages

    • Re: How to get Apache to write files as group writable?
      ... >> created by the web server in any way, only the GID of those files (if ... >> write permissions set for the UID and GID of the file. ... > The reason why I need apache to have write permissions set for the UID ... > reason why my local users and apache are all in the 'www' group. ...
      (Fedora)
    • Re: How to get Apache to write files as group writable?
      ... >> Paul. ... > the group apache runs as from apache to www (or whatever group you ... using the SGID bit on a directory, the GID of newly-created files will ...
      (Fedora)
    • Re: change directory GID to -1
      ... > I want the group Apache is part of, to have some specific permission on ... You really sure the GID is -1? ... you can't set the gid of a file/directory to "-1", in setregid() a program ... You would be better off changing the Apache group to a new value that is NOT ...
      (alt.linux)
    • apache security + php + cgi
      ... One of my problems with security was Apache and user's cgi i php files. ... performance reasons I cannot use suExec wraper, besides this do not solve all ... I needed to run Apache with diffrent uid and gid for each ...
      (comp.os.linux.security)
    • apache security + php + cgi
      ... One of my problems with security was Apache and user's cgi i php files. ... performance reasons I cannot use suExec wraper, besides this do not solve all ... I needed to run Apache with diffrent uid and gid for each ...
      (comp.security.unix)