Django [Errno 13] 权限被拒绝:'/var/www/media/animals/user_uploads' [英] Django [Errno 13] Permission denied: '/var/www/media/animals/user_uploads'
问题描述
我正在开发一个 django API，它将在运行 Ubuntu 的服务器上通过 WSGI 在 Apache2 之上运行.
用户将能够使用 POST 请求将他们拍摄的照片上传到服务器.API 处理此请求，然后尝试将图像写入 /var/www/media/animals/user_uploads/.
另一个坏解决方案是:
sudo chown -R www-data/var/www/这会将所有者更改为 www-data，这会打开安全漏洞.
好的解决方案是:
sudo groupadd varwwwusers须藤 adduser www-data varwwwusers须藤 chgrp -R varwwwusers/var/www/须藤 chmod -R 760/var/www/这会将 www-data 添加到 varwwwusers 组，然后将其设置为 /var/www/ 和所有它的子文件夹.chmod 将授予所有者读取、写入、执行权限，但如果网络服务器被黑客入侵，该组将无法执行可能上传到那里的任何脚本.
您可以将其设置为 740 以使其更安全，但是您将无法使用 Django 的 collectstatic 功能所以坚持到 760 除非您对自己正在做的事情非常有信心.
I am developing a django API which will be running on top of Apache2 via WSGI on a server running Ubuntu.
Users will be able to upload pictures they take to the server using a POST request. The API processes this request and then attempts to write the image to /var/www/media/animals/user_uploads/<animal_type>/<picture_name>.jpg. In case there is no directory /var/www/media/animals/user_uploads/<animal_type>/ it will create it.
When testing during development everything was fine, both using Windows and Scientific Linux. When testing on the deployment server, I receive this error:
From what I understand, the Apache2 server is running using the user www-data. In my case, running cat /etc/passwd to get the list of users, this is what I get for www-data:
www-data:x:33:33:www-data:/var/www:/bin/sh
I am assuming this means that www-data has access to everything in /var/www/. I have tried:
chmod 777 -R media
This worked but it is obviously a very bad way to solve this. Is there a better way to solve this?
This is my wsgi.py:
import os, sys
os.environ.setdefault("DJANGO_SETTINGS_MODULE", "serengeti.settings")
sys.path.append('/serengeti/django/serengeti')
sys.path.append('/serengeti/django')
from django.core.wsgi import get_wsgi_application
application = get_wsgi_application()
I have this in my settings.py file:
MEDIA_ROOT = '/var/www/media/'
MEDIA_URL = os.path.join(BASE_DIR,'/media/')
My vhost.conf contains this:
Alias /media/ /var/www/media/
I have solved this myself in the end.
When running on the development machines, I am in fact running using my current user's privileges. However, when running on the deployment server, I am in fact running through wsgi, which means it's running using www-data's privileges.
www-data is neither the owner nor in the group of users that own /var/www. This means that www-data is treated as other and has the permissions set to others.
The BAD solution to this would be to do:
sudo chmod -R 777 /var/www/
This would give everyone full access to everything in /var/www/, which is a very bad idea.
Another BAD solution would be to do:
sudo chown -R www-data /var/www/
This would change the owner to www-data, which opens security vulnerabilities.
The GOOD solution would be:
sudo groupadd varwwwusers
sudo adduser www-data varwwwusers
sudo chgrp -R varwwwusers /var/www/
sudo chmod -R 760 /var/www/
This adds www-data to the varwwwusers group, which is then set as the group for /var/www/ and all of its subfolders. chmod will give read, write, execute permissions to the owner but the group will not be able to execute any script potentially uploaded in there if for example the webserver got hacked.
You could set it to 740 to make it more secure but then you won't be able to use Django's collectstatic functionality so stick to 760 unless you're very confident about what you're doing.
这篇关于Django [Errno 13] 权限被拒绝:'/var/www/media/animals/user_uploads'的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
