I am trying to tighten the security with Apache running on my web server (also called Jailing apache). Going on the recommendations of many, I have created a separate user for the httpd service of Apache. I have prohibited local and network login via group policy for this user (named “apache”, a member of the “users” group). Most people say that I should completely deny access to all local drives, and then specifically allow read/execute access to the apache software folder.
I have apache, mysql, and php installed in a folder on my E:\ partition. I have my doc root in a folder on my D:\ partition.
So far, I have Denied full control (using Properties -> Security -> Advanced and checked Replace permission entries on child objects to my C, D, and E partitions. I then went into my E: drive to the Apache folder and unchecked “Allow inheritable permissions from the parent…” so that I can make specific permissions. I then allow the following permissions under Properties -> Security -> Advanced: (Traverse Folder/Execute file, List Folder/Read Data, Read Attributes, Read Extended Attributes, Read Permissions)
The rest is specifically denied. I check “replace permission entries on child objects”
I then repeat this process for the “logs” folder except I also allow the writing attributes.
However, when I go to start the service, it doesn’t let me and tells me to refer to the Event viewer, where there is no entry. I know this is a permissions issue, because if I grant the apache user full control to everything on the drive, it starts fine.
I have tried messing with the permissions, but I can’t seem to get the service to start while denying the user the ability to see what is on the drive (read and execute). I know it is possible, because it is recommended to do this by so many, but I must be messing up somewhere.
Can anyone help me with this?