1

I have just installed a Ubuntu server that will hold a lot of different websites for which I want to add a CMS control panel.

For security reasons I will have all websites being owned by, for example, site-x:site-x.

The CMS site is owned by www-data:www-data and I need to add a silent permission to all sites so that www-data:www-data can read and write to their files... But they cannot read/write from each other or www-data:www-data.

How can I set this up?

2 Answers 2

1

Why not add www-data into each of the other groups? So that www-data is also a member of site-x group. (and site-y, site-z, etc)

You can do this via usermod: usermod -a -G site-x www-data will add the user www-data to the site-x group. It can then write any files site-x owns, that has the group write bit on.

0
0

However, adding www-data to sites groups isn't really secure. As I know www-data is user for apache webserver, and any malicious script from site-x can read/write site-y data when called from web.

I propose create special user for CMS, runs cms under suexec and add it to sites group.

2
  • How can it do that? If www-data belongs to group site-x it means that it can do everything the group site-x can. But user site-x cannot do everything that group www-data can and therefore it wouldn't be able to read/write site-y Mar 2, 2010 at 8:12
  • I mean not site-x, but www-data user. For example, if you use mod_php on site-x, that all php scripts called through apache on site-x has beed executed under www-data user. Mar 2, 2010 at 16:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .