Aegir Permissions Best practices

Dane,

The problem is really with PHP / Apache, not Aegir specifically. I'd say the problem is widespread for shared PHP hosting, and probably most Aegir installations would be susceptible to something like the following:

• User writes a module that finds all settings.php files on the serever
• Module makes a MySQL dump of each database on the system using the settings
• Module also has a file browser component that allows the module uploader to browse all files on the system. Most web files will need to be readable by the web server user, so would be available

I've actually seen Joomla modules in the wild like this, but never seen a Drupal one. I suspect they exist though.

The solution is to run each virtualhost as a different user, but there really isn't any nice way to do this that I'm aware of. As mig5 pointed out, mpm-itk has been tried but kind of dropped, and as far as I can see it is not actively maintained any more. One thing I have read about it (but haven't had the chance to confirm) is that each Apache process has a lifetime of one request. If this is true it's basically a non starter from my point of view.

Probably the most commonly used method is using FastCGI and Suexec. This seems to have a few limitations but basically works and seems to be the most commonly deployed mechanism by people running shared hosting. I have had this running in test environments, but have never tried it with Drupal.

If anyone has any better solutions I'd be keen to hear.

I've kind of stopped using Aegir now, because I need lots of different users to be able to upload files, modules, etc, and despite my best efforts the permissions usually get stuffed enough for Aegir to not be able to run upgrades, do backups, etc. In the end it just became easier to manage it manually.

I actually use something similar to your proposed set up of site dirs in the user directories symlinked from the core installs. I use Puppet to manage the roll out of apache configuration over multiple web servers, and a few convenience scripts for setting up / checking out scm, managing modules, etc. I suspect you may be able to configure Aegir to do but not sure how much work this would be and what sort of overhead you would incur reapplying to each Aegir upgrade. Going against the grain like this in Drupal usually ranges from painful to agonising in my limited experience ;) That said, Aegir is one of the better pieces of code in the Drupal world so it may not be so bad.