Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #231336

Re: website permissions and ownership

Show all headers | View raw

On 2/02/21 10:37 pm, john doe wrote:
> On 2/2/2021 9:55 AM, Richard Hector wrote:
>> On 2/02/21 9:11 pm, Jeremy Ardley wrote:
>>>
>>> On 2/2/21 3:09 pm, Richard Hector wrote:
>>>> Hi all,
>>>>
>>>> I'm reviewing how I set up websites (mostly Wordpress at the moment),
>>>> and would like other opinions on what I'm planning is sane.
>>>>
>>>> My plan is to have a user eg "mysite" that owns all/most of the
>>>> standard files and directories.
>>>>
>>>> The webserver (actually php-fpm) would run as "mysite-run".
>>>>
>>>> Group ownership of the files would then be mysite-run, but
>>>> group-write permission would not be granted except where required, eg
>>>> the 'uploads' and 'cache' directories.
>>>>
>>>> Files in those directories, created by the php-fpm process, would
>>>> obviously be owned by mysite-run.
>>>>
>>>> Alternatively the group ownership of most of the directories could
>>>> remain with mysite, and but the uploads and cache directories
>>>> group-owned (and group-writeable) by mysite-run.
>>>>
>>>> The objective of course is that site code can't write to anything it
>>>> shouldn't. I know that means that I'll have to install upgrades,
>>>> plugins etc with the wp cli tool.
>>>>
>>>> I earlier had thoughts of improving this with ACLs, but a) this got
>>>> really complicated and b) it didn't seem to solve some of the
>>>> problems I was trying to solve.
>>>>
>>>> I wanted to be able to allow other users (those who might need to
>>>> update sites) to be able to log in as themselves and make changes,
>>>> but IIRC nothing (other than sudo or setuid tools) will allow them to
>>>> set the ownership back to 'mysite', which is what I want it to be.
>>>> I'm aware of bindfs, which allows fuse mounting of filesystems with
>>>> permission translation, but as far as I can tell, it doesn't allow
>>>> mapping of userids. Tools could help, but I'd rather some of these
>>>> users had SFTP access only, which would prevent them being used.
>>>>
>>>> Any thoughts?
>>>> Am I mostly on the right track?
>>>>
>>>> Thanks,
>>>> Richard
>>>>
>>>
>>> What you are doing sounds pretty O.K. Though I personally also use
>>> SELinux for web facing services.
>>
>> Thanks.
>>
>> I haven't looked in to SELinux. I looked at AppArmor, but it appears
>> that it won't work as expected in an LXC container, which is where I run
>> this. Would SELinux work there? SELinux, from what I can see, seems more
>> complex to learn than AppArmor.
>>
>>> To accomodate other users I suggest you set up staging areas where
>>> they can upload content that you periodically sync to the website
>>> using a privileged process. This means you don't have to give any
>>> rights to users other than access to the staging areas.
>>
>> Yes. I can foresee difficulties with my clients not being able to see
>> their changes immediately.
> Inotify could be of interest there by monitoring the staging area.
> 
> 
> 1)  https://man7.org/linux/man-pages/man7/inotify.7.html

Agreed. Worth bearing in mind, thanks. Though IIRC it's quite a pain to 
keep watch on an entire directory tree; you have to maintain the list of 
watched directories rather than just watching the top.

Cheers,
Richard

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

website permissions and ownership Richard Hector <richard@walnut.gen.nz> - 2021-02-02 08:10 +0100
  Re: website permissions and ownership Jeremy Ardley <jeremy@ardley.org> - 2021-02-02 09:20 +0100
    Re: website permissions and ownership Richard Hector <richard@walnut.gen.nz> - 2021-02-02 10:00 +0100
      Re: website permissions and ownership Jeremy Ardley <jeremy@ardley.org> - 2021-02-02 10:40 +0100
        Re: website permissions and ownership Jeremy Ardley <jeremy@ardley.org> - 2021-02-02 10:50 +0100
          Re: website permissions and ownership Richard Hector <richard@walnut.gen.nz> - 2021-02-02 11:00 +0100
      Re: website permissions and ownership john doe <johndoe65534@mail.com> - 2021-02-02 10:40 +0100
        Re: website permissions and ownership Richard Hector <richard@walnut.gen.nz> - 2021-02-02 10:50 +0100
  Re: website permissions and ownership Kenneth Parker <sea7kenp@gmail.com> - 2021-02-02 12:50 +0100

csiph-web