12

Im having issues as to which user should own my www directory - ftp or apache? When set to the ftp user, the user can add, remoe and easily modify files but php file system actions generate permission denied errors (ofcourse because they require the user to be apache). If however, the www directory is chown to apache, the ftpuser wont be able to perform some actions like file modification and deletion. Any one ever encountered similar issue? What's the fix? Thanks

3 Answers 3

16

This is what groups are for.

You can add the ftp user to the apache group, and vice-versa. Or, even better, you could add them to a third group that you create specifically for this purpose.

e.g.

# groupadd mygroup
# useradd -G mygroup ftp
# useradd -G mygroup apache
# chown -R :mygroup /var/www
# chmod -R g+rw /var/www

Those commands do the following:

  1. Creates new group 'mygroup'
  2. Adds ftp user to mygroup
  3. Adds apache user to mygroup
  4. Recursively grants group ownership to contents of /var/www/ to mygroup
  5. Recursively grants group read & write perms to contents of /var/www/

You just need to make sure that files added in the future belong to the 'mygroup' group and have the appropriate permissions for both apache and ftp to read/write them.

4
  • 3
    Combining "find /var/www -type d -print0 | xargs -0 chmod g+s /var/www" with a umask of 002 will ensure that new files and directories in /var/www inherit the appropriate group and permissions for the group to have r/w access. Many Linux distributions now default to a umask of 002 (the same ones that default to creating a new group for every new user)
    – freiheit
    Sep 25, 2010 at 3:15
  • This answer works perfectly! But I am having one issue where the user can still view all the other directories outside of var/www is there a method to restrict this?
    – maxisme
    Feb 5, 2015 at 13:10
  • 4
    Lines 2 and 3 won't work if the users already exist (on CentOS 7). In this case use usermod e.g. usermod -G mygroup ftp
    – nick
    Nov 20, 2015 at 15:15
  • Simple, self-explanatory, understandable! Perfect! Thanks, @hobodave!
    – GTodorov
    Jun 26, 2016 at 0:33
4

Most of your content should be owned by a user other than apache. Assuming your use FTP to update your content, you can set all the files to be owned by ftp:apache. I would suggest using SCP for SFTP instead of ftp. Files should have permissions 644 or 640 and directories permissions 755 or 750.

For files and directories the application needs to write to add group write access.

0

I had a similar problem with a php page a built that would copy a folder on the server with a different name. I fixed it by turning off php safe mode.

1
  • 2
    PHP safe mode is there for a reason. Turning it off isn't a good idea at all.
    – user9517
    Nov 4, 2011 at 8:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .