1

I have a few simple web apps deployed on external providers. For testing and debugging I run local instances (on-demand basis, not all the time) on localhost:80 using apache.

These are hosted directly from my Code/ folders since that's where I'm making edits. Previously those folders were on a separate directory tree (/home/data/...../Code) but due to a directory structure reorganization I'm moving the Code folder to my own home folder (~/..../Code). Of course, this means that apache won't allow it to load unless I change permissions on ~ to 755 from 700.

My laptop is single-user, and remote access (as far as I can tell) is only permitted through sshd (key-only, no password logins allowed) and the apache-hosted sites (as I also test how the page will appear on my smartphone sometimes). Am I increasing my risk profile by giving 755 permissions to ~? I'm particularly worried about ~/.ssh and similar sensitive directories, but those already deny read permission to anyone but my own user.

1

755 is usually the default permission for home directories, but if you want you could limit it to the Code directory and use setfacl to limit it to the apache user only:

# Set exec on parent directories
setfacl -m u:www-data:x ~
setfacl -m u:www-data:x ~/foo
setfacl -m u:www-data:x ~/foo/bar
# Recursively set default acl
setfacl -R -d -m u:www-data:rX ~/foo/bar/Code
# Recursively set acl for existing files
setfacl -R -m u:www-data:rX ~/foo/bar/Code

(props to RichardNixon for reminding me that parent directories will need exec permission)

Note that your apache user could be www-data, httpd, apache, or something else depending on your distro.

0

You should be able to set the permissions on your home directory to something like 0701 and then set the group on the directory you want Apache to be able to see to 750 with setting the group of that directory to the group of the user that Apache is running as.

So something like this:

chmod o+x ~/
chmod -R g+rx ~/directoryWhereFilesAre/
chgrp -R www-data ~/directoryWhereFilesAre/

Where 'www-data' is the name of the default group of your Apache user and 'directoryWhereFilesAre' is the top directory of where you keep the files you want accessable via Apache.

This does leave your home directory open to any user being able to access your home directory but they need to already know the name and location of a file/directory AND have read permission on that file/directory to access it. Probably this is safe on a single user system but only you can decide that based on your willingness to accept that risk.

0

I sincerely doubt that "Apache...requires 755 permissions", it is more likely that the webserver requires to be able to read the content it is expected to serve. How you provision that capability is a very different question to what you asked.

The webserver requires this permission regardless of where the files are deployed.

There are 2 issues to be addressed:

While you may be the only person whom should be deploying files on your laptop, appropriate permissions are part of the artefact, therefore the mechanism you choose for provisioning those permissions should span as much of the deployment space as possible - that might be a fix script (with per host config) which you run after deploying content, or a static definition which might grant write access to a named group, with the setgid bit set on directories.

The other issue is that you may inadvertently create new files which are exposed by the webserver. This is mitigated by ensuring that the webserver is configured to only read from directories specifically designated for the purpose. If you must have those files within your home directory (rather than having a symbolic link within your home directory to the actual document root) then use mod_userdir and ~/public_html, use a symlink from within the document_root back to the content directory along with options +followlinks, or add an alias for the directory. Although personally I would lean towards keeping the editable content in your home directory, updating it into a local version control system and deploying it from there into the document root when you want to run it.

If you are setting the executable bit on content files then you are weakening the security of your system - this is only required for directories.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.