1

I have a websites that should be completely accessible for Apache(www-data user) and I have an ftp user(that has the same username on the server: user1) that should be able to update the website.

I need the user to be able to add files to the website directory, but the www-data should have a full access to the added files.

user1 is a member of www-data group.

For now when user1 uploads file to the server the file has a rights: 644, but I need 664.

How I could organise it.

Many thanks

1

1 Answer 1

4

The best way to fix this is to avoid using standard unix permissions as enforcement.

The following four commands should resolve this:

setfacl -d -m apache:rwx -R /path/to/shared/folder
setfacl -d -m user1:rwx -R /path/to/shared/folder
setfacl -m apache:rwx -R /path/to/shared/folder
setfacl -m user1:rwx -R /path/to/shared/folder

This alters the behaviour of the file using POSIX ACLS so that both your FTP user and apache can alter / remove / create files inside of that directory regardless of who the orginal author was.

ACL masks are defined by the standard unix bits for group. ACLs can tell a directory is a diretory as it inevitably has a +x in it. A file will typically not so even if you have an ACL set as rwx inside of it the +x part will be masked by the group permission bit not being set.

Another way is to use suPHP, suExec or some other 'change user on execution of program' method. But personally I find those methods less convenient than this.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .