1

I'm setting up a SLES 12 system for running web applications on it. There is already a /srv/www folder and it's owned by root. So I'm going to reassign it to another user.

Is there a good practice / standard in Suse Linux Enterprise Server, what user should own the web root (and it's files and sub-folders recursively)? In Ubuntu e.g. this user is www-data. Is it applicable to SLES? Or should the Apache user wwwrun be the owner of the web root? Or maybe another special user?

automatix
  • 702
  • 3
  • 7
  • 20

1 Answers1

2

Who's the owner of the folder doesn't really matter as long as it's not the same user as the http server is running under, which is probably wwwrun on SUSE (better double check that). Because otherwise all your folders and file would be writable by Apache and that would be a big security hole. What matters is that all the files and folders are not writable by other users, because that would be the same as the already mentioned situation.

aardbol
  • 1,473
  • 4
  • 17
  • 26
  • Thank you for you answer! What folder should be then the home of this special "web user"? Maybe you could answer [this question](https://serverfault.com/q/997925/158057) as well? Thanks! – automatix Jan 07 '20 at 12:16
  • The user Apache runs under doesn't need a home directory per se. It runs under a different user than root or your own user for security reasons. So it doesn't have access to files and folders it doesn't need access to. – aardbol Jan 07 '20 at 16:04