Give apache permission to write to /home/*/www/ directories

Question

LAMP server newbie here:

I have a web server (on a VPS that I have full root access to), in which I'm setting up a few users with websites for.

I have apache2 and php set up, and I have manually specified a few sites for them under the /etc/apache2/sites-enables directory (symlinking them from sites-available, as per normal).

I don't actually use the /var/www/ directory, instead opting for the following sort of set up:

/home/user1/www/websiteone.com/
/home/user1/www/subdomain.websiteone.com/
/home/user1/www/differentwebsiteone.com/
/home/user2/www/websitetwo.com/
/home/user3/www/websitethree.com/

etc, etc, etc. I hope you can see where I'm getting at.

I have two issues though:

1. Apache cannot write to these directories. Is there a simple, clear explanation on how I can achieve this for all /home/*/www/ directories ONLY (and recursively) to be writable by www-data, without giving user1 write access to user2 and so on? A simple step that retroactively works on all future users is preferred, but I don't mind manually setting it up should it be impossible.

2. Secondly: In some cases, I would like, say, user2 to have access to the differentwebsiteone.com files (in user1's home directory), but not give them access to anything else (so, some sort of symlink appears as /home/user2/www/differentwebsiteone.com). Can I achieve this easily? Maybe moving the site files to /var/www/ and symlinking to their respective home directories? Or something? Advice is much appreciated!

Thanks!

Answer 1

Apache runs as a single user for all sites, so if you gave it access to write to /home/user1/www , user2 would also be able to write PHP scripts that can write to /home/user1/www. You need to run PHP outside of the normal methods to be able to separate users.

There's a good write up here on the merits of the various methods:

http://boomshadow.net/tech/php-handlers/

I like fastcgi myself, but if you don't need performance, suPHP is probably what you want.

Another interesting new one not mentioned there is LXC containers, which really weren't all that usable in 10.04, but since then have matured quite a bit. This allows you to create what looks like another server inside your VPS, but its not virtualized.. its just contained within its own process space.