Permissions on ServerRoot directories
In typical operation, Apache is started by the root user, and it
switches to the user defined by the User
directive
to serve hits. As is the case with any command that root executes,
you must take care that it is protected from modification by nonroot
users. Not only must the files themselves be writable only by root,
but so must the directories and parents of all directories. For
example, if you choose to place ServerRoot in
/usr/local/apache, then it is suggested that you
create that directory as root, with commands like these:
mkdir /usr/local/apache cd /usr/local/apache mkdir bin conf logs chown 0 . bin conf logs chgrp 0 . bin conf logs chmod 755 . bin conf logs
It is assumed that /, /usr, and
/usr/local are only modifiable by root. When you
install the httpd
executable, you should ensure
that it is similarly protected:
cp httpd /usr/local/apache/bin chown 0 /usr/local/apache/bin/httpd chgrp 0 /usr/local/apache/bin/httpd chmod 511 /usr/local/apache/bin/httpd
You can create an htdocs subdirectory that is
modifiable by other users — since root
never
executes any files out of there and shouldn’t be
creating files in there.
If you allow nonroot users to modify any files that
root
either executes or writes on, then you open
your system to root
compromises. For example,
someone could replace the httpd
binary so that the next time you start it, it will execute some arbitrary code. If the logs directory is writable (by a nonroot user), someone could ...
Get Apache: The Definitive Guide, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.