Re: How to get Apache to write files as group writable?
From: Paul Howarth (paul_at_city-fan.org)
Date: 09/15/05
- Previous message: Brian D. McGrew: "FS Type and Partition Sizes"
- In reply to: Jay Paulson: "Re: How to get Apache to write files as group writable?"
- Next in thread: George N. White III: "Re: How to get Apache to write files as group writable?"
- Reply: George N. White III: "Re: How to get Apache to write files as group writable?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Thu, 15 Sep 2005 16:43:33 +0100 To: For users of Fedora Core releases <fedora-list@redhat.com>
Jay Paulson wrote:
>>> I also found that in the /etc/httpd/conf/httpd.conf file you can
>>> change the group apache runs as from apache to www (or whatever group
>>> you want). Then start up /etc/init.d/httpd as root for it to take
>>> effect (at least that what it says in the httpd.conf file).
>>> My question now is which is the better way?
>>> I'll have to try both ways. :)
>>
>>
>> The two things are completely different.
>>
>> Changing the group in /etc/httpd/conf/httpd.conf just changes group
>> that apache runs as. It will not affect the permission bits of files
>> created by the web server in any way, only the GID of those files (if
>> you're using the SGID bit on a directory, the GID of newly-created
>> files will be the same as the directory, otherwise, the GID of the
>> running process).
>>
>> Be careful about the UID/GID you run httpd as, and the
>> UID/GID/permissions of the files on your system. Security-wise, the
>> httpd should run with just enough permissions to be able to function
>> correctly, i.e. it should not be able to write to most files, just
>> read the files it's serving and write to files/directories that you
>> want to be able to upload to.
>>
>> Changing the umask to 002 will mean that newly-created files will have
>> write permissions set for the UID and GID of the file.
>>
>> Paul.
>
>
> Thanks for the explanation it makes perfect sense to me and the security
> issue you bring up is very serious.
>
> The reason why I need apache to have write permissions set for the UID
> and the GID is that I have other users who log in locally and will need
> access to modify those files that are uploaded via apache. Hence the
> reason why my local users and apache are all in the 'www' group. This,
> as you pointed out, isn't best for security, which really does concern me.
>
> Is there a more secure way of setting this up so that files that are
> created by apache are writable by the group and the local users without
> compromising the security of the rest of the files on the web root
> through apache?
Try this:
- create a new group specifically to cover the area that httpd and your
local users should be able to write to, and add user apache and your
local users to that group.
- change the GID of that directory and everything underneath it to the
new group.
- set the SGID bit on that directory and all directories underneath it
so that new files created there have the correct group ID.
- change httpd.conf back to the default of running as user and group apache.
- make sure that your web root is not owned by user apache so that it
cannot write to it.
- start httpd with a umask of 002 so that it sets the group write bit on
any files it creates.
Paul.
-- fedora-list mailing list fedora-list@redhat.com To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
- Previous message: Brian D. McGrew: "FS Type and Partition Sizes"
- In reply to: Jay Paulson: "Re: How to get Apache to write files as group writable?"
- Next in thread: George N. White III: "Re: How to get Apache to write files as group writable?"
- Reply: George N. White III: "Re: How to get Apache to write files as group writable?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
|
