6

I want encrypt my /var/www folder so I and apache had access.
How can I done this?
I tried use ecryptfs, but my sites does not work.

Please write example, or link for manual.

1
  • Just curious, what is the point ? You are serving out the files in /var/www with your http server ? The files need to be decrypted to serve them out. I am going to guess you want to set the proper permissions on your files and/or use apparmor to confine apache and /or secure your server, but I do not see any point of adding encryption. See askubuntu.com/questions/46331/…
    – Panther
    Mar 24, 2014 at 18:30

4 Answers 4

6

You could use eCryptfs to do this.

You'd need to do this as the root user, though. Here's some instructions that would work:

root@server-59314:~# ecryptfs-setup-private
Enter your login passphrase:
Enter your mount passphrase [leave blank to generate one]:
************************************************************************
YOU SHOULD RECORD YOUR MOUNT PASSPHRASE AND STORE IT IN A SAFE LOCATION.
  ecryptfs-unwrap-passphrase ~/.ecryptfs/wrapped-passphrase
THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME.
************************************************************************
Done configuring.
Testing mount/write/umount/read...
Inserted auth tok with sig [37d1d7fcf453d9d0] into the user session keyring
Inserted auth tok with sig [974bb07127cbe922] into the user session keyring
Inserted auth tok with sig [37d1d7fcf453d9d0] into the user session keyring
Inserted auth tok with sig [974bb07127cbe922] into the user session keyring
Testing succeeded.
Logout, and log back in to begin using your encrypted directory.

And then you would need to login as root, and run ecryptfs-mount-private. Note that you will probably want to ensure that /var/www is not unmounted when root logs out. To do this, just rm -f /root/.ecryptfs/auto-umount.

Full disclosure: I am one of the maintainers of the eCryptfs project.

0
4

See http://ubuntuforums.org/showthread.php?t=1655933

However, since the key is unlocked on boot you still won't gain anything unless ofc if someone enters your serverhall, removes your disk and then tries to gain access to it w/o testing to put the disk into any other computer (of the same architecture) and tries to boot it up.

You COULD possibly do a full-disk encryption (bad idea since you won't be able to decrypt your computer via SSH) or so that you'll have to unlock the encryption, but then you've ended up with a server that cannot be rebooted without having to worry about maintenance afterwards.

8
  • I used this manual, but apache don't seeing /var/www/site-visible folder. For example i create two folders /var/www/site-enc, /var/www/site-vis. encrypt /var/www/site-enc folder, and mount it to /var/www/site-vis. Site files put to /var/www/site-enc. Encryption, decryption works fine. Next step I added site to apache configuration, but after apache restart I have error, /var/www/site-vis not found. What is wrong? Any ideas?
    – Pivasyk
    Feb 20, 2012 at 14:53
  • has the www-data user/group got chmod-access to those folders?
    – sakjur
    Feb 20, 2012 at 15:11
  • I use sudo chown username:www-data orfos-vis/ but have error Permission denied, sudo chmod 0777 orfos-vis chmod has error too.
    – Pivasyk
    Feb 20, 2012 at 16:10
  • This error when apache restarted Warning: DocumentRoot [/var/www/site-vis] does not exist, but folder is exist :)
    – Pivasyk
    Feb 20, 2012 at 16:35
  • try running chown -R to run chown recursively :)
    – sakjur
    Feb 20, 2012 at 18:22
1

If you've already encrypted your home folder then you can easily point apache to read a subdirectory inside ~/ through a symlink.

That's how I set up my system. I created a symlink under /var/www that points to a folder inside my home folder (ie. ln -s /home/francesco/www/default /var/www/default)

Find below my /var/www content:

root@Terminus:/var/www# ls -lah
total 8K
drwxr-xr-x  4 francesco www-data 4.0K Mar 24 14:52 .
drwxr-xr-x 15 root      root     4.0K Feb  7 09:46 ..
lrwxrwxrwx  1 francesco www-data   28 Mar 24 14:52 default -> /home/francesco/www/default/

Now you should add apache (www-data) to your group and viceversa:

usermod -a -G www-data francesco
usermod -a -G francesco www-data

I did it because I need to launch PHP scripts on the command-line from my user and apache still needs to read and write the same files (but I guess you can use setfacl).

Now you should change your home folder permissions and the permissions of your document root folder (in my case ~/www/default). Please be careful and do not launch the chmod command using the recursive option on your home folder, use it just on the document root folder as follows:

sudo chmod 0755 /home/francesco
sudo chmod -R 0755 /home/francesco/www
1
  • But what will happen if someone is able to take the server's hard disk and then attach it to another computer in which he/she the root user?
    – SaidbakR
    Jun 6, 2018 at 20:51
0

I would suggest you to encrypt only the files in the www folder instead of encrypting the entire folder. The same will decrypt in memory when the file is called.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .