3

To allow write access to Apache, I needed to chown www-data:www-data /var/www/mysite/uploads to my site's upload folder. This allows me to delete files from the folder via unlink() in a PHP script.

Unfortunately, this prevents another PHP script, which uses FTP functions, from working. I think it is because the FTP user is mike and now that the uploads directory is owned by www-data, mike cannot access it.

I added mike to the group www-data, but this does not fix the issue.

Can somebody advise me on how to allow PHP FTP functions to work in addition to file deletion using PHP's unlink() function?

4
  • what's the group permissions on /var/www/mysite/uploads set to?
    – Zypher
    May 19, 2010 at 21:11
  • @Zypher: Group permissions for /var/www/mysite/uploads are r-s
    – Mike Moore
    May 19, 2010 at 21:13
  • @letseatfood and in /var/www/mysite?
    – jneves
    May 19, 2010 at 23:38
  • @jneves Group permissions for /var/www/mysite are r-s
    – Mike Moore
    May 20, 2010 at 0:20

2 Answers 2

7

That would be why, you need the 'write' permission to delete files. You have a couple of options here.

  1. chwon /var/www/mysite/uploads to www-data:mike and chmod to 775 (rwxrwxr-x)
  2. Create an ftp-write group and chown /var/www/mysite/uploads to www-data:ftp-write and chmod to 775
  3. just chmod to 775 (rwxrwxr-x) and leave mike as part of the www-data group
  4. set an acl on the folder for mike with setfacl -m user:mike:rwx
  5. Create an ftp-write group, add mike and the group (as well as any other users that need these permissions with setfacl -m group:<ftp_group>:rwx
2
  • #3 worked (chmod 775 /var/www/mysite/uploads and leaving mike in the group www-data). Is this an okay solution?
    – Mike Moore
    May 20, 2010 at 0:23
  • @letseatfood: yep perfectly acceptable :) I listed them in no particular order.
    – Zypher
    May 20, 2010 at 0:25
0

Filesystem permissions should be enough to fix your problem there. Try something like chmod o+rw on the uploads directory ONLY. The chmod command effectively says "give anyone that's not in the www-data group read and write permissions."

The longterm fix, though, would be to use a service account for your script that calls FTP, and to bundle that particular service account with www-data.

4
  • You don't want to be giving the "other" set o permissions more rights than you need to, chmod'ing the group is sufficient and opens less security risks.
    – Zypher
    May 19, 2010 at 23:51
  • Would you elaborate about the longterm fix that you mentioned?
    – Mike Moore
    May 20, 2010 at 0:23
  • Oh, do you mean that I should create a user specifically for FTP that is in the group www-data?
    – Mike Moore
    May 20, 2010 at 5:36
  • yes, that is the correct way to do so
    – Tony
    May 21, 2010 at 23:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .