Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #231335

Re: website permissions and ownership

Show all headers | View raw

On 2/2/2021 9:55 AM, Richard Hector wrote:
> On 2/02/21 9:11 pm, Jeremy Ardley wrote:
>>
>> On 2/2/21 3:09 pm, Richard Hector wrote:
>>> Hi all,
>>>
>>> I'm reviewing how I set up websites (mostly Wordpress at the moment),
>>> and would like other opinions on what I'm planning is sane.
>>>
>>> My plan is to have a user eg "mysite" that owns all/most of the
>>> standard files and directories.
>>>
>>> The webserver (actually php-fpm) would run as "mysite-run".
>>>
>>> Group ownership of the files would then be mysite-run, but
>>> group-write permission would not be granted except where required, eg
>>> the 'uploads' and 'cache' directories.
>>>
>>> Files in those directories, created by the php-fpm process, would
>>> obviously be owned by mysite-run.
>>>
>>> Alternatively the group ownership of most of the directories could
>>> remain with mysite, and but the uploads and cache directories
>>> group-owned (and group-writeable) by mysite-run.
>>>
>>> The objective of course is that site code can't write to anything it
>>> shouldn't. I know that means that I'll have to install upgrades,
>>> plugins etc with the wp cli tool.
>>>
>>> I earlier had thoughts of improving this with ACLs, but a) this got
>>> really complicated and b) it didn't seem to solve some of the
>>> problems I was trying to solve.
>>>
>>> I wanted to be able to allow other users (those who might need to
>>> update sites) to be able to log in as themselves and make changes,
>>> but IIRC nothing (other than sudo or setuid tools) will allow them to
>>> set the ownership back to 'mysite', which is what I want it to be.
>>> I'm aware of bindfs, which allows fuse mounting of filesystems with
>>> permission translation, but as far as I can tell, it doesn't allow
>>> mapping of userids. Tools could help, but I'd rather some of these
>>> users had SFTP access only, which would prevent them being used.
>>>
>>> Any thoughts?
>>> Am I mostly on the right track?
>>>
>>> Thanks,
>>> Richard
>>>
>>
>> What you are doing sounds pretty O.K. Though I personally also use
>> SELinux for web facing services.
>
> Thanks.
>
> I haven't looked in to SELinux. I looked at AppArmor, but it appears
> that it won't work as expected in an LXC container, which is where I run
> this. Would SELinux work there? SELinux, from what I can see, seems more
> complex to learn than AppArmor.
>
>> To accomodate other users I suggest you set up staging areas where
>> they can upload content that you periodically sync to the website
>> using a privileged process. This means you don't have to give any
>> rights to users other than access to the staging areas.
>
> Yes. I can foresee difficulties with my clients not being able to see
> their changes immediately.
Inotify could be of interest there by monitoring the staging area.


1)  https://man7.org/linux/man-pages/man7/inotify.7.html

--
John Doe

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

website permissions and ownership Richard Hector <richard@walnut.gen.nz> - 2021-02-02 08:10 +0100
  Re: website permissions and ownership Jeremy Ardley <jeremy@ardley.org> - 2021-02-02 09:20 +0100
    Re: website permissions and ownership Richard Hector <richard@walnut.gen.nz> - 2021-02-02 10:00 +0100
      Re: website permissions and ownership Jeremy Ardley <jeremy@ardley.org> - 2021-02-02 10:40 +0100
        Re: website permissions and ownership Jeremy Ardley <jeremy@ardley.org> - 2021-02-02 10:50 +0100
          Re: website permissions and ownership Richard Hector <richard@walnut.gen.nz> - 2021-02-02 11:00 +0100
      Re: website permissions and ownership john doe <johndoe65534@mail.com> - 2021-02-02 10:40 +0100
        Re: website permissions and ownership Richard Hector <richard@walnut.gen.nz> - 2021-02-02 10:50 +0100
  Re: website permissions and ownership Kenneth Parker <sea7kenp@gmail.com> - 2021-02-02 12:50 +0100

csiph-web