Solved DocumentRoot on apache

[balanga]

Who is the owner:group of the DocumentRoot directory and all its content?

Having been caught out previously by permission denied errors in the browser, I now make sure that files/directories involved are owned by www:www.

 

[SirDice]

now make sure that files/directories involved are owned by www:www.

Ehm, no. Suppose your web application gets hacked. Then they'll have access with the www user, if this user has write access to the document root (or other directories) they'll have all the access needed to completely wreck your website, insert malware, deface it.

Leave permissions as root:wheel, and give 'other' read access (and execute on directories). That's enough for the web server to be able to serve the content. The www user rarely needs write permissions, although some web applications might have a cache or temp directory. Set write permissions on those directories and nowhere else.

 

[drhowarddrfine]

SirDice It's been a while, and my memory is foggy on this, but a while back, we had a proliferation of small sites we managed and we moved them all to /www from /usr/local/www to get them out of the way. I really don't remember the details but I expressed concern about having them starting from root. Afterwards I found other companies did such a thing--having a /www directory. Thoughts on this?

 

[SirDice]

having a /www directory. Thoughts on this?

Not my preference, but I see no problems with it as long as the permissions/ownership are all sound. It's not going to make much difference if the webserver got hacked where the exact path on the filesystem is. Lots of people seem to think www is some sort of super limited user account, it's not. It's a user account like any other. It can do anything any regular user could do on the system, including starting processes and opening listening ports (above 1024).

 

[balanga]

Creating /www goes against sacred FreeBSD philosophy!