daq Posted May 5, 2007 Share Posted May 5, 2007 I have a folder that wwwrun (user apache runs as) has no read access to, but I need to be able to download from that folder. I realize that adding wwwrun to users group is dangerous, but that is the only solution I could find for now. I closed http ports on external interface and download files from apache through an SSH tunnel as a security measure while I'm looking for a better solution. Is there any way to give a VHost elevated privileges for one directory? I would really rather not run two apache daemons where one has elevated privileges but cannot be accessed from outside except through SSH tunnel. Any suggestions welcome. Quote Link to comment Share on other sites More sharing options...
steviewdr Posted May 8, 2007 Share Posted May 8, 2007 Alias /downloaddir "/var/private/wwwrun/" Quote Link to comment Share on other sites More sharing options...
daq Posted May 9, 2007 Author Share Posted May 9, 2007 I feel stupid, thanks a lot! Could you explain how it goes around permissions? or point me to a link where it's explained? Quote Link to comment Share on other sites More sharing options...
steviewdr Posted May 9, 2007 Share Posted May 9, 2007 I dont have a handy link where it is explained in depth. Im sure its in the apache manual. As for permissions, it uses the underlying file permissions. If its not chmod'd 644 or 755 (i.e. readable by the webserver) it wont be served. Think of the alias as a symlink (ln -s source destination) for apache. -steve Quote Link to comment Share on other sites More sharing options...
daq Posted May 9, 2007 Author Share Posted May 9, 2007 OK, I guess I made the question unclear. While Alias was helpful, I was using symlink to serve the same purpose, my problem was with permissions. The problem still remains. To be honest I was looking for something more like suExec -- I couldn't find a good tutorial on it anywhere. Thanks for your help though. Quote Link to comment Share on other sites More sharing options...
steviewdr Posted May 12, 2007 Share Posted May 12, 2007 Apologies - I have read your first post more clearly. Thus: "I have a folder that wwwrun (user apache runs as) has no read access to, but I need to be able to download from that folder". I use suPHP on one of the compsoc servers. It works very well. Php will SU to the owner of the php script, giving different permissions (similar to suEXEC). Note the cgi version of php is required for suPHP to work. More info here: https://wiki.skynet.ie/Users/suPHP and https://wiki.skynet.ie/Admin/SetupGuides/suPHP Rgds, Steve Quote Link to comment Share on other sites More sharing options...
the_oliver Posted May 13, 2007 Share Posted May 13, 2007 <Directory "/usr/local/thefile"> Options None AllowOverride None Order allow,deny Allow from all </Directory> You will find that SELinux will oftern get it the way of these! However if you have the time to make this work propaly for you it could be very usefull to you. Quote Link to comment Share on other sites More sharing options...
daq Posted May 14, 2007 Author Share Posted May 14, 2007 Thanks, that's exactly what I was looking for! Apologies - I have read your first post more clearly. Thus: "I have a folder that wwwrun (user apache runs as) has no read access to, but I need to be able to download from that folder". I use suPHP on one of the compsoc servers. It works very well. Php will SU to the owner of the php script, giving different permissions (similar to suEXEC). Note the cgi version of php is required for suPHP to work. More info here: https://wiki.skynet.ie/Users/suPHP and https://wiki.skynet.ie/Admin/SetupGuides/suPHP Rgds, Steve Quote Link to comment Share on other sites More sharing options...
steviewdr Posted May 15, 2007 Share Posted May 15, 2007 No problems. Glad you found what you were looking for. suPHP is also on apt in Debian and Ubuntu. apt-cache search suphp Rgds, Steve Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.