Apache – How to set secure permissions for multiple users and multiple websites

apache-httpdgentoopermissionsPHPSecurity

On a Gentoo 3.2.12 server with apache2+php, there are several websites running:

/www
    /website1
    /website2
    ...etc

The apache user should have read-only access to all the websites. There are also a few folders inside each website where apache should have read-write access (upload folders and the like).

There are several people who work on these websites. Each person should have read-write access to the website(s) they work on, but not others. Also, they should be able to set permissions (within their websites) so that apache can write to some folders (well, if they create a new upload folder or something).

Other users shouldn't have access to /www at all.

Can this be done and how?

(PS. Also… since these people can upload PHP scripts which are then executed in the context of Apache, I guess they can access other websites too, indirectly… is it possible to secure this as well? I can't think of a way, but who knows…)

Best Answer

One way would be this:

  • Have a group for each site, have the persons in that group use umask 0002 so the files they create are read/write for the group and readable for others by default.
  • chmod a-rwx the root directory of each site, to prevent access by people outside the allowed group.
  • Enable ACLs for your file system, and setfacl -m user:apache:rx that directory to grant read access to the apache user, in addition to the other permissions.

As to the files created by the apache process:

  • Reading files created by the apache user should be possible for the relevant group, as long as they are created world-readable.
  • Deleting files is possible as long as they reside in a group-writable directory.
  • If that is not enough, you could allow your users to sudo to the apache user. Perhaps only to execute specific commands, e.g. add group write permissions using ACLs.

But as you stated, all of the read restrictions can be circumvented if users can run arbitrary scripts as the apache user. To counter that, you could try to have the scripts of one site executed as a specific user in the corresponding group. I believe there is a way to set this up using mod_fcgid. Otherwise apache[suexec] and php[cgi] might work for you.

To get even better isolation, you'd have to have multiple apache processes, running as different users, and perhaps even chrooted to different directories. Or in different OpenVZ units, or different Xen domUs, or on different hardware. As you can see, there are a lot of different isolation levels, each providing better isolation than the one before, at the cost of mre resource demands.

Related Question