Converting server to allow Apache write access to certain directories, does this solution look right?
0
votes
1
answer
2355
views
I've been at this all day and think I finally figured it out, but want to make sure before I put it into production.
I'm changing my server to allow the
apache:apache
user write permission on a few directories. I'm the only user jeff:jeff
on the server.
My directory structure looks something like this:
/home/jeff/www/ 0755 jeff:jeff
/home/jeff/www/example1.com/ 0755 jeff:jeff
/home/jeff/www/example2.com/ 0755 jeff:jeff
/home/jeff/www/example2.com/uploads/ 0755 apache:apache
**The problem is:**
I run chmod apache:apache uploads/
to allow apache
write access.
Whenever I want to edit a file in uploads/
via sftp, I have to chown
it back to jeff:jeff
, then reverse when I'm done.
**My preliminary solution is:**
- Add apache
user to jeff
group
- Give jeff
group write permission on uploads/
dir via manual chmod 775
- Force apache
user to create any new files + folders + subfolders as apache:jeff
. Requires setgid 2775
on uploads/
dir
- Force apache
user to create any new files + folders + subfolders with umask 002
= 775
via [systemd](https://stackoverflow.com/a/31154944/142233)
I'm only about 50% sure I've got all this right.
Does it sound okay? Is there a better way? Did I miss anything?
**With Jim's help, here is the final solution I used:**
For my reference.
# usermod --append --groups apache jeff
> Relogin all sessions
# chown -R apache:apache www/example.com/uploads/
# find www/example.com/uploads/ -type d -exec chmod 775 {} \;
# find www/example.com/uploads/ -type f -exec chmod 664 {} \;
# systemctl edit --full php.service
-----------
[Service]
UMask=0002
-----------
# systemctl daemon-reload
# systemctl restart php
WordPress users will want to add this to their wp-config.php:
define('FS_CHMOD_DIR', 0775);
define('FS_CHMOD_FILE', 0664);
Asked by Jeff
(846 rep)
Apr 24, 2023, 09:44 PM
Last activity: Apr 25, 2023, 07:12 PM
Last activity: Apr 25, 2023, 07:12 PM