Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I am running Ubuntu 11.04 desktop with encrypted home directories. I do development work on my computer and I want to have my webroot directory to be within my home directory so it is encrypted with the rest of my home directory. As I am the only use of the machine, I want to configure Apache to point to this directly.

Current I have changed the /var/www folder into a symbolic link to the workspace in my hone dir: /home/valorin/workspace

However, this throws 403 Forbidden errors in apache.

I have added my user into the www-data group, and set the ownership & permissions on the workspace folder:

drwxrwxr-x  2 valorin www-data  4096 2011-04-23 10:02 workspace

But the only way I can get it to work is to change my home dir group to be www-data and set permissions too. I don't really want to do this as it means Apache has access to my home dir and could possibly be used by someone on my network to get into my personal data.

Does anyone know how I can solve this problem?

share|improve this question
add comment

1 Answer 1

up vote 4 down vote accepted

You can leave your $HOME dir ownership alone. You don't need to set it to www-data. What you do have to do is ensure that Apache has execute permissions on $HOME and everything above it. So, you could do something like this:

chmod 751 "$HOME"
sudo chmod 751 /home

However, the fact that $HOME is encrypted might pose major problems for Apache unless you can somehow configure Apache to use the proper decryption key.

EDIT:

Setting execute permissions on a directory means only that you can access something inside the directory if you already know its name and if what you're trying to access also has correct permissions. So setting a global x-bit on $HOME isn't too much of a security risk, as long as all your other files have reasonable permissions. You might want to look into your umask to be sure.

share|improve this answer
    
Awesome, that worked, thanks :) In regards to the encryption, when I am logged in the folder is accessible to the system - so this is not an issue (luckily!). Does that mean that any user can execute/run scripts within my home dir if they know the path? or do they need Read access for that too? –  Valorin Apr 23 '11 at 0:42
2  
They also need read permission. –  Scott Severance Apr 23 '11 at 0:48
    
I was hoping that was the answer, thanks heaps once again :) –  Valorin Apr 23 '11 at 0:50
    
@Valorin: If you intend for Apache to only be able to serve pages while you're logged in, then I'm assuming it's just being used as a development box. In that case, you might also consider configuring Apache to only serve pages to 127.0.0.1. That will provide a bit on additional security. –  Scott Severance Apr 23 '11 at 0:50
    
Yep, it's a development machine and I've already configured localhost access only :) –  Valorin Apr 23 '11 at 1:08
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.