4

I have 2 RHEL 7 servers running Apache 2.4 behind a load-balancer. Both connect to an NFS data store where web pages are held and both servers run ssh to allow users to put web data on them. The users authenticate using AD. I have no control over AD. Users can have multiple virtual hosts that I create for them upon request. So ls -l /web would look something like:

700 user1:ad_user vhost1.example.com  
700 user1:ad_user vhost2.example.com          
700 user2:ad_user vhost3.example.com     
700 user2:ad_user vhost4.example.com         
700 user5:ad_user vhost5.example.com

So how can I keep users in there own vhosts, out of other users vhosts, and let apache serve up all their pages?

  • apache runs as apache:apache
  • I can't make a apache part of the ad_user group. It would be a local groups and would not have the same ID as the one from AD.
  • I have tried making everyone a member of the apache group and making the following changes.

    750 user1:apache  vhost1.example.com  
    750 user1:apache  vhost2.example.com          
    750 user2:apache  vhost3.example.com     
    750 user2:apache  vhost4.example.com         
    750 user5:apache  vhost5.example.com     
    

While this allows apache to do its thing, users can now get into each other's websites

  1. I have "heard" that there is an apache module that will handle this situation but I can't find it .... if it's really out there.

  2. I'm thinking that SELinux handle all the permissions to do this but I'm an SELinux noob.

  • 1
    Isn't this what cPanel is supposed to do? It also gives users a way to edit their configuration through the web. – Stephen Ostermiller Jun 8 '17 at 20:13
  • 1
  • Stephen, thank you for replying. I did not know about cPanel. Looking into it also put me onto other similar products that "may" do the job. Have you, or any other reader, ever used a program called "Kloxo-MR"? It too looks interesting. – Mike Jun 15 '17 at 12:50
  • I've never used any of them myself. Hopefully somebody with more experience in this area can give you an answer. – Stephen Ostermiller Jun 15 '17 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.