Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have just installed a Ubuntu server that will hold a lot of different websites for which I want to add a CMS control panel.

For security reasons I will have all websites being owned by, for example, site-x:site-x.

The CMS site is owned by www-data:www-data and I need to add a silent permission to all sites so that www-data:www-data can read and write to their files... But they cannot read/write from each other or www-data:www-data.

How can I set this up?

share|improve this question
up vote 1 down vote accepted

Why not add www-data into each of the other groups? So that www-data is also a member of site-x group. (and site-y, site-z, etc)

You can do this via usermod: usermod -a -G site-x www-data will add the user www-data to the site-x group. It can then write any files site-x owns, that has the group write bit on.

share|improve this answer
Cool, thank you :) – Christoffer Mar 1 '10 at 8:13

However, adding www-data to sites groups isn't really secure. As I know www-data is user for apache webserver, and any malicious script from site-x can read/write site-y data when called from web.

I propose create special user for CMS, runs cms under suexec and add it to sites group.

share|improve this answer
How can it do that? If www-data belongs to group site-x it means that it can do everything the group site-x can. But user site-x cannot do everything that group www-data can and therefore it wouldn't be able to read/write site-y – Christoffer Mar 2 '10 at 8:12
I mean not site-x, but www-data user. For example, if you use mod_php on site-x, that all php scripts called through apache on site-x has beed executed under www-data user. – Michael Zarubin Mar 2 '10 at 16:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.