AWSTATS - manual update error (permissions)

Question

Error: Couldn't open file "/var/www/awstats/awstats032014.site.net.tmp.9198" for write: Permission denied 

Setup ('/etc/awstats/awstats.site.net.conf' file, web server or permissions) may be wrong.
Check config file, permissions and AWStats documentation (in 'docs' directory).

I get this error when manual trying to update awstats (via the browser link). I have set the folder permissions of /var/www/awstats/ to 775 and still get the error.

If I create a new file on that folder the default permission setting set the permissions to 774 which should work.

Solution

The permissions drwxrwxr-x root root mean that only the root user and members of the root group can write to that directory. Creating or deleting files within a directory is considered to be writing to that directory so the permissions checks are done against the containing directory when you try to create the file /var/www/awstats/awstats032014.site.net.tmp.9198.

The other half of this problem is that it is Apache that is doing the creating of files. Apache usually runs as the www-data user on Debian based systems and as httpd on RedHat based systems. These users are not in the root group and so cannot write to that directory.

The principle of least privilege suggests that we should make a change that allows just what we want and no more. So I think changing the directory owner to the Apache user would do the job.

chown www-data /var/www/awstats

You can also change the mode back to 755 from 775 if you want and it will still work.

Instead of changing the ownership, you could change the group of the directory, or add the www-data user to the root group, or change the mode of the directory to 777. The latter two allow much more than just what we're trying to do here and hence should be considered dangerous.

Comments

[Ladadadada]

The Unix permissions model includes users and groups which you have omitted from your question. Without knowing what user and group the file belongs to, only the 5 in the permissions 775 has any meaning to us. The directory, the file itself and the process attempting to access the file will all have a user and a group. Could you add them to your question?

[Lewis]

It's a temporary file so I can't be sure as it doesn't exists after this error is produced however the non-temporary version of the file has these permissions: -rw-r--r-- 1 root root 6662

[ETL]

The directory /var/www/awstats has permissions.

[Lewis]

That comes up as drwxrwxr-x 9 root root

[screaming drills]

this fixed half my problem, but I still had to run as sudo to get it to work