/
4.9 Apache Creating Online Shares

4.9 Apache Creating Online Shares

Owned by Tin Pham
Last updated: May 16, 2011Version comment

I am not happy with the private share portion of this article.

Introduction

I often find I need to quickly share files with the general public or selected friends. As such I have setup Online Shares with Apache. Continuing our example I will put put a public and private share on krypton as follows,

www.krypton.com/shared/ - accessible by everyone
www.krypton.com/shared.private/ - only accessible by specific people

Also if possible, this setup should allow the website admins to do the setup without the need for the server admin to come in and perform root actions.

Assuming you are logged in as a Staff User created in the Setup Ubuntu Linux Base Server,

Shared - Public Share Folder

cd /home/www.krypton.com
sudo mkdir shared # Browseable folder to drop content to share with others
sudo mkdir shared.private # Browser password protected folder to drop content to share with others via .htaccess
sudo mkdir keys # Place to store keys for protected folder

cd /home

sudo chown -R serveradmin:wgkryptonian ./www.krypton.com/shared/

sudo chmod -R 775 www.krypton.com/shared/ # Only svradm and users in the kryptonian group can manage. Apache(other's) still need to be able to read and browse.

Add to the website host file,

Alias /shared/ "/home/www.krypton.com/shared"
    Alias /shared "/home/www.krypton.com/shared"
    <Directory /home/www.krypton.com/shared>
        /# Make this folder browseable
        Options +Indexes
    </Directory>

The final host file will look like this,

<VirtualHost *:80>
    ServerAdmin webmaster@localhost

    ServerName www.krypton.com
    ServerAlias www.krypton.com

    DocumentRoot /home/www.krypton.com/www

    # This restrictive a precedence for ALL directory blocks.
    <Directory />
        Options FollowSymLinks
        # This prevents use of .htaccess
        AllowOverride None
    </Directory>

    # Main location of static content for the websites.
    <Directory /home/www.krypton.com/www/>
        Options +MultiViews
        Order Allow,Deny
        Allow from all
    </Directory>

    Alias /shared/ "/home/www.krypton.com/shared"
    Alias /shared "/home/www.krypton.com/shared"
    <Directory /home/www.krypton.com/shared>
        # Make this folder browseable
        Options +Indexes
    </Directory>

    ErrorLog /var/log/apache2/www.krypton.com.error.log

    # Possible values include: debug, info, notice, warn, error, crit, alert, emerg.
    LogLevel warn

    CustomLog /var/log/apache2/www.krypton.com.access.log combined
</VirtualHost>

Reload the Apache configuration file,

sudo /etc/init.d/apache2 reload

shared.private - Private Folders

kalel wants to have a private place to store his documents that can only be access by accounts he sets up.

This is working but has a caveat outlined in notes and a bug in AllowOverride which I am documenting.

htpasswd and the directive AllowOverride in the shared.private directory block will be used to accomplish this.

kalel logs in as himself he would do the following one time setup,

cd /home/www.krypton.com/shared.private
mkdir kalel
chmod 750 kalel

cd /home/www.krypton.com/shared.private
mkdir keys
cd keys

# Create the initial password file with the first user being kalel
htpasswd -c kalel-www.krypton.com.shared.private kalel
New password:
Re-type new password:

# Create addition accounts. Notice NO "-c"
htpasswd kalel-www.krypton.com.shared.private cclark

One caveat, this also prevents Apache's Index program from viewing the directory so you must know about the directory or put a link to the directory. Consider using .htaccess definition one level higher, but then it's easy to break.... hmmmm...

# Enables directory listing
Options +Indexes

# Enable authentication, see http://httpd.apache.org/docs/2.0/howto/auth.html
AuthType Basic
AuthName "Password Required"
AuthUserFile /home/www.krypton.com/keys/kalel-www.krypton.com.shared.private
Require valid-user

If kalel wants to define additional user accounts and passwords in kalel-www.krypton.com.shared.private this can be accomplished by groups. Further details are on Apache's website at Authentication, Authorization and Access Control.

This will serve well for most users. However, keep in mind that by default /home/www.krypton.com/shared.private/kalel/ is still accessible by other users who can log into the system such as jimmyolsen.

To make his folder more private, kalel makes a request to serveradmin (who has sudo privileges) to make the following changes,

# assuming the user is serveradmin or any other account with sudo privileges
sudo chmod -R 750 /home/www.krypton.com/shared.private/kalel/
sudo chown -R kalel:www-data /home/www.krypton.com/shared.private/kalel/

Now only kalel and user's belong to the group www-data (which is required for the Apache Web Server) can access the folderĀ  /home/www.krypton.com/shared.private/kalel/.

Update the virtual host as follows,

Alias /shared/ "/home/www.krypton.com/shared"
    Alias /shared "/home/www.krypton.com/shared"
    <Directory /home/www.krypton.com/shared>
        # Make this folder browseable
        Options +Indexes
    </Directory>

    Alias /shared.private/ "/home/www.krypton.com/shared.private"
    Alias /shared.private "/home/www.krypton.com/shared.private"
    <Directory /home/www.krypton.com/shared.private>

        # Allow website admin to use .htaccess - http://httpd.apache.org/docs/2.2/mod/core.html,
        #     AuthConfig - Authentication
        #     Indexes - Makes directory browseable
        # As soon as I introduce Indexes it breaks with error, ".htaccess: Options not allowed here".
        #AllowOverride AuthConfig Indexes

        # This works but allowing all is a security risk
        # AllowOverride All

        # Start TEMP solution

        # Allow the .htaccess file to allow authentication.
        AllowOverride AuthConfig

        # For some reason allowing override of indexes does not work in .htaccess so set it manually here.
        Options +Indexes

        # End TEMP solution

    </Directory>

    ErrorLog /var/log/apache2/www.krypton.com.error.log

Reload the configuration file,

sudo /etc/init.d/apache2 reload

You can now browse to the folder, http://www.krypton.com/shared.private through a browser and it will first prompt for an id in the kalel-www.krypton.com.shared.private file before showing the files in that folder.

Should put a screen-shot here.