0

When I use shell I can't list the directories of local home users created by useradd or through virtual min ls -ls /home/someuser/ permission denied

but I can list directories created by root. what group I should add those users to safely without affecting security of web server. I run separate php processes for each user and want to keep it from accessing any other place.

1 Answer 1

0

You could make the root directory of the home directory world readable. This wouldn't change the mode of the files or the other directories that is subdirectories of the instant home directory.

You could do this with:

$ sudo chmod go+x /home/someuser

The above mode parameters are:

g - group access
o - others/everyone else
x - execute (in this case directory access)

If you want to restrict a directory (the home directory to a specific group, for instance the default group of the web server you could set the group owner of the directory to www-data and use only the g of the command, leaving out the o for others as in:

$ sudo chgrp www-data /home/someuser
$ sudo chmod g+x /home/someuser

It might be more convenient to use the chmod go+x command for the root directory of the user and create a sub-directory of your php programs.

By the way, by default your web applications will be running under the www-data group.

4
  • thanks. I have my php-fpm socks running under each user to separate them not under www-data. still I cannot cd in their home. I guess I have to add them to another group and add my shell user to the same group. would that be a security problem? Apr 8, 2016 at 7:57
  • When something is running over the web-server it is run under the group that you have specified to run the server. The default is www-data. You could change the group to a different group. You can also check to see the user and group by making a php file to create a file in /tmp/ and looking at the properties of the file that is created. The only way that a web server is going to be able to access a directory is to have access permitted by the group or owner of the server. Apr 8, 2016 at 10:03
  • @Dreadedsemicolon By the way, there are special conditions that can be setup, of which I'll need a little more space than is available from the comments. I'll update my answer with formatted conditions later when I get to my computer. Apr 8, 2016 at 10:09
  • php-fpm can be setup to listen under www-data but runs under different user/group. not sure how it works though. but I did test. it works. socks in /var/run shows www-data,but in home directory php writes and reads as the user. Any directory not under the user/group name php can't read or write which what i wanted. still it is cumbersome not being able to cd into user directories from my ssh with sudo. Apr 8, 2016 at 11:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.