Fixed: Apache - PHP permissions to create / edit files and directories?

Question

I have a server on rackspace clouds... Fedora 13, and I installed apache, mysql.

Now, I have a piece of code (PHP) that my web app uses a lot. It works on my local machine running XAMPP, but when I upload this code on my rackspace server, it doesn't work:

$myFile = "textfile.txt";
$fh = fopen($myFile, 'w') or die("cant open");
$stringData = "CONTENT";
fwrite($fh, $stringData);
fclose($fh);

Really simple PHP code that should just work. However, it wont create the file, and if I upload textfile.txt file myself, and give the permissions myself to 0666 then it edits the file. However, this isn't ideal, since it still wont create new files (or directories) and chmoding each one by hand isn't feasible.

The owner of the file is root and the group is root

How do I make this work?

UPDATE - Fixed

I changed the owner to apache:apache doing: chown -R apache:apache /var/www/html

That seemed to work :)

Is there any security issues with that, or is that fine to have the user apache and the group apache?

Thanks!

Solution

Giving the apache user write access to your entire DocRoot is not ideal. I usually configure things a bit differently.

First I identify a place where the files will be written - this can be in the DocRoot, or it can be in a separate location that's brought in with an Alias configuration in apache.

I create a group (usually called www-pub) and add the apache user to it.

Then I do

chown root:www-pub <directory>

and

chmod g+rwxs <directory>

which sets the setgid bit, meaning that any files or directories created under the top will have the same group as the parent directory, as well as being writable (and readable) by that group.

That way, you restrict where and what the apache user can get at, but still allow file creation and so forth in that area only.

Comments

[DylanJones_md]

Interesting, my display errors is off, I will try that.

[DylanJones_md]

Oh okay, I will try this. Why is having apache user write access not ideal? If I keep it this way, will it come back to bite me in the future?

[malcolmpdx]

Consider a scenario where there's a bug in apache that allows an attacker to write files as the apache user. If you set your DocRoot and below as writable by apache, then at a minimum, the attacker could delete all your files, or deface your site. Generally speaking, limiting what files a networked services can write to the bare minimum required is a good idea.

[malcolmpdx]

Oh, and I should also add that once you create the group and add apache into it, you'll need to restart apache to have it pick up the new group membership.