added the user 'apache' to a file's group but apache cannot read it. Why?

It's very strange I cannot find an answer to this problem on the forums as
many of you must have tried to do this:

I want to give a client the right to connect with SSH to my web server in
order to modify his files.
But of course, I don't want him to modify other users' files.

That's why all his files are set to:
user : web1_admin
group : web1
with chmod: rwxrwx---

Another client's files configuration is :
user: web2_admin
group: web2
with chmod: rwxrwx---

So obviously client web1_admin won't be able to modify web2_admin's files.

I've added the user 'apache' to the groups 'web1' and 'web2' so that it can
read files.

But it doesn't work and I get a 503 error when trying to access a file from
a browser.

What am I doing wrong?

Is there another way to prevent a client to view other clients' files when
connected with SSH?

Thanks for your help.

Henri

On Fri, 23 May 2008 17:36:13 +0200, HmFireball wrote:

> It's very strange I cannot find an answer to this problem on the forums
> as many of you must have tried to do this:
>
> I want to give a client the right to connect with SSH to my web server
> in order to modify his files.
> But of course, I don't want him to modify other users' files.
>
> That's why all his files are set to:
> user : web1_admin
> group : web1
> with chmod: rwxrwx---
>
> Another client's files configuration is : user: web2_admin
> group: web2
> with chmod: rwxrwx---
>
> So obviously client web1_admin won't be able to modify web2_admin's
> files.
>
> I've added the user 'apache' to the groups 'web1' and 'web2' so that it
> can read files.
>
> But it doesn't work and I get a 503 error when trying to access a file
> from a browser.
>
> What am I doing wrong?
>
> Is there another way to prevent a client to view other clients' files
> when connected with SSH?
>
> Thanks for your help.
>
> Henri

This is a linux question, not an apache one (apache is available for
windblows...).

1/ I assume that each user has an account, and that they are putting
their web content in ~/public_html/

/2 Their permissions should look something like this:

[chris@develop ~]$ ls -la /home/chris/public_html/
total 208
drwxrwxr-x 4 chris chris 4096 2008-05-11 17:02 ./
drwxr-xr-x 55 chris chris 4096 2008-05-24 08:21 ../
-rw-rw-r-- 1 chris chris 330 2008-04-26 10:10 check_function.php
-rw-rw-r-- 1 chris chris 323 2008-04-25 21:57 check_function.php~
-rw-r--r-- 1 chris chris 1413 2008-04-06 20:22 common.php
-rw-r--r-- 1 chris chris 3281 2008-04-13 07:43 entry.php
-rw-r--r-- 1 chris chris 3283 2008-04-06 20:22 entry.php~
drwxrwxr-x 3 chris chris 4096 2008-04-12 16:33 font/
drwxr-xr-x 5 chris chris 4096 2008-04-12 16:33 fpdf153/
-rwxr-x--x 1 chris chris 42263 2008-04-06 20:22 fpdf.php*
-rwxr-xr-x 1 chris chris 963 2008-04-06 20:22 hello.php*
-rw-rw-r-- 1 chris chris 2421 2008-05-11 17:02 index.php
-rw-rw-r-- 1 chris chris 2429 2008-05-11 17:00 index.php~
-rw-r--r-- 1 chris chris 342 2008-04-06 20:22 log.session
-rw-r--r-- 1 chris chris 11944 2008-04-06 20:22 log.webprj
-rw-r--r-- 1 chris chris 19 2008-04-06 20:22 phpinfo
-rw-r--r-- 1 chris chris 19 2008-04-06 20:22 phpinfo~
-rwxr-xr-x 1 chris chris 19 2008-04-06 20:22 phpinfo.php*
-rw-r--r-- 1 chris chris 4561 2008-05-11 13:04 plot.php
-rw-r--r-- 1 chris chris 4492 2008-05-11 12:47 plot.php~
-rw-r--r-- 1 chris chris 3512 2008-04-06 20:22 test.php
-rw-r--r-- 1 chris chris 3510 2008-04-06 20:22 test.php~
[chris@develop ~]$

3/ note that apache only has to read the files, and therefore does not
have to be a member of the user's group to be operational.

4/ apache has to be configured to use public_html directories.
the configuration file should be /etc/httpd/conf/httpd.conf and should
have the following line uncommented (remove any leading #s)

LoadModule userdir_module modules/mod_userdir.so


have fun!
Chris Roy-Smith

"HmFireball" <hmfireball@hotmail.com> wrote in message
news:4836e4cd$0$927$ba4acef3@news.orange.fr...
> It's very strange I cannot find an answer to this problem on the forums as
> many of you must have tried to do this:
>
> I want to give a client the right to connect with SSH to my web server in
> order to modify his files.
> But of course, I don't want him to modify other users' files.
>
> That's why all his files are set to:
> user : web1_admin
> group : web1
> with chmod: rwxrwx---
>
> Another client's files configuration is :
> user: web2_admin
> group: web2
> with chmod: rwxrwx---
>
> So obviously client web1_admin won't be able to modify web2_admin's files.
>
> I've added the user 'apache' to the groups 'web1' and 'web2' so that it
> can read files.
>
> But it doesn't work and I get a 503 error when trying to access a file
> from a browser.
>
A 503 error? are you sure it isn't 403?

If you've added the apache user to new groups, you'll need to do a full
restart of apache.
You'll also need at least 'x' permissions for apache on any directory in the
path to your various document roots.

Thanks for you answer to both of you.
You were right Phantom, I simply didn't know I had to restart Apache server.
Now that I did it, it works!
Thanks again for your help!

Henri

"phantom" <nobody@blueyonder.invalid> a écrit dans le message de
news:o7RZj.8588$DZ6.95@text.news.virginmedia.com.. .
> "HmFireball" <hmfireball@hotmail.com> wrote in message
> news:4836e4cd$0$927$ba4acef3@news.orange.fr...
>> It's very strange I cannot find an answer to this problem on the forums
>> as many of you must have tried to do this:
>>
>> I want to give a client the right to connect with SSH to my web server in
>> order to modify his files.
>> But of course, I don't want him to modify other users' files.
>>
>> That's why all his files are set to:
>> user : web1_admin
>> group : web1
>> with chmod: rwxrwx---
>>
>> Another client's files configuration is :
>> user: web2_admin
>> group: web2
>> with chmod: rwxrwx---
>>
>> So obviously client web1_admin won't be able to modify web2_admin's
>> files.
>>
>> I've added the user 'apache' to the groups 'web1' and 'web2' so that it
>> can read files.
>>
>> But it doesn't work and I get a 503 error when trying to access a file
>> from a browser.
>>
> A 503 error? are you sure it isn't 403?
>
> If you've added the apache user to new groups, you'll need to do a full
> restart of apache.
> You'll also need at least 'x' permissions for apache on any directory in
> the path to your various document roots.
>
>