I want encrypt my /var/www
folder so I and apache
had access.
How can I done this?
I tried use ecryptfs
, but my sites does not work.
Please write example, or link for manual.
I want encrypt my /var/www
folder so I and apache
had access.
How can I done this?
I tried use ecryptfs
, but my sites does not work.
Please write example, or link for manual.
You could use eCryptfs to do this.
You'd need to do this as the root user, though. Here's some instructions that would work:
root@server-59314:~# ecryptfs-setup-private
Enter your login passphrase:
Enter your mount passphrase [leave blank to generate one]:
************************************************************************
YOU SHOULD RECORD YOUR MOUNT PASSPHRASE AND STORE IT IN A SAFE LOCATION.
ecryptfs-unwrap-passphrase ~/.ecryptfs/wrapped-passphrase
THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME.
************************************************************************
Done configuring.
Testing mount/write/umount/read...
Inserted auth tok with sig [37d1d7fcf453d9d0] into the user session keyring
Inserted auth tok with sig [974bb07127cbe922] into the user session keyring
Inserted auth tok with sig [37d1d7fcf453d9d0] into the user session keyring
Inserted auth tok with sig [974bb07127cbe922] into the user session keyring
Testing succeeded.
Logout, and log back in to begin using your encrypted directory.
And then you would need to login as root, and run ecryptfs-mount-private. Note that you will probably want to ensure that /var/www is not unmounted when root logs out. To do this, just rm -f /root/.ecryptfs/auto-umount
.
Full disclosure: I am one of the maintainers of the eCryptfs project.
See http://ubuntuforums.org/showthread.php?t=1655933
However, since the key is unlocked on boot you still won't gain anything unless ofc if someone enters your serverhall, removes your disk and then tries to gain access to it w/o testing to put the disk into any other computer (of the same architecture) and tries to boot it up.
You COULD possibly do a full-disk encryption (bad idea since you won't be able to decrypt your computer via SSH) or so that you'll have to unlock the encryption, but then you've ended up with a server that cannot be rebooted without having to worry about maintenance afterwards.
/var/www/site-visible
folder. For example i create two folders /var/www/site-enc
, /var/www/site-vis
. encrypt /var/www/site-enc
folder, and mount it to /var/www/site-vis
. Site files put to /var/www/site-enc
. Encryption, decryption works fine. Next step I added site to apache configuration, but after apache restart I have error, /var/www/site-vis not found
. What is wrong? Any ideas?
sudo chown username:www-data orfos-vis/
but have error Permission denied
, sudo chmod 0777 orfos-vis
chmod has error too.
Warning: DocumentRoot [/var/www/site-vis] does not exist
, but folder is exist :)
If you've already encrypted your home folder then you can easily point apache to read a subdirectory inside ~/ through a symlink.
That's how I set up my system. I created a symlink under /var/www
that points to a folder inside my home folder (ie. ln -s /home/francesco/www/default /var/www/default
)
Find below my /var/www
content:
root@Terminus:/var/www# ls -lah
total 8K
drwxr-xr-x 4 francesco www-data 4.0K Mar 24 14:52 .
drwxr-xr-x 15 root root 4.0K Feb 7 09:46 ..
lrwxrwxrwx 1 francesco www-data 28 Mar 24 14:52 default -> /home/francesco/www/default/
Now you should add apache (www-data) to your group and viceversa:
usermod -a -G www-data francesco
usermod -a -G francesco www-data
I did it because I need to launch PHP scripts on the command-line from my user and apache still needs to read and write the same files (but I guess you can use setfacl).
Now you should change your home folder permissions and the permissions of your document root folder (in my case ~/www/default
). Please be careful and do not launch the chmod command using the recursive option on your home folder, use it just on the document root folder as follows:
sudo chmod 0755 /home/francesco
sudo chmod -R 0755 /home/francesco/www
I would suggest you to encrypt only the files in the www
folder instead of encrypting the entire folder. The same will decrypt in memory when the file is called.