Re: Permissions

Thomas Waldmann wrote:

>> I am cleaning up the Gentoo ebuild for moinmoin, and I have a quick 
>> question I hope you can help me with. What files does the httpd need 
>> write access to? Right now I'm doing the equivalent of chown -R 
>> apache:apache * , and I'd really like something cleaner. 
>
>
> Additionally to what Florian already said, try to do it without giving 
> world access to data/ - there are critical informations inside there 
> like ACL protected pages and user accounts, so they shouldnt be 
> readable to everybody on FS level.
>
>
I run like this:

my admin/shell user  is moin in group moin
apache runs as 'www-data.www-data' as normal
however user www-data is also a member of group moin (in /etc/groups)

umask is 007

Every directory underneath ~moin/ is setguid and either 660 or 770
This means that any new files or directories created by either moin or 
www-data are in group moin and mode g+rw(x)
So user moin isn't prevented from accessing anything created by www-data 
and vice-versa.
Nothing is in any way world accessible at all.

I think this is as close as I can figure to a 'proper' way to set things up.

(I don't have root on my hosting box and this works fine so I'm pretty 
confident too!)

HTH

David



-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click