www-data security issue across multiple sites in a vps

Question

I recently bought a VPS and learned a lot from it. I manged to create an ftp user, set it as the owner of my site's document root, add it to the www-user group, set the group as the group of the document root and give files 0775 (0664) permissions.

My question is, if www-data can access and modify the files in the document root, won't the scripts from other sites also be able to modify those files (which are now protected from the public using .htaccess)?

NOTE: I want www-data to have write access since PHP scripts should be able to modify the files.

How to solve this issue?

score 4 · Accepted Answer · answered Oct 07 '16 at 15:02

4

To solve this issue, you had to run each site instance with its own credential, rather than using www-data.

If using apache, you can use apache-mpm-itk and its AssignUserID parameter to assign a specific user/group to each different site/virtualhost. With this method, both apache, php, cgi, ecc will be run with the assigned credentials.

Another, php-specific approach is suPHP, which basically runs your php scripts using specific user/group credentials.

answered Oct 07 '16 at 15:02

shodanshok

44,038
6
98
162

Great answer! I have a doubt: what is the difference between apache-mpm-it and mpm-peruser? – Nandakumar Edamana Oct 07 '16 at 15:26
1

It simply is a (less used) alternative module to run per-user confined `apache` instance. – shodanshok Oct 07 '16 at 16:21

score 0 · Answer 2 · answered May 09 '17 at 20:53

I think it's best not to let Apache user or group write in all your document root. Use apache-mpm-itk/suPHP/mpm-peruser or not, maybe you should detect which files and directories Apache really needs to write (per site), and give group write permissions only to those files/directories.

www-data security issue across multiple sites in a vps

2 Answers2