Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm setting up an Ubuntu server that will have 3 or 4 VirtualHosts that I want users to be able to work in (add new files, edit old files, etc.). I currently plan on storing the sites in /var/www but wouldn't be opposed to moving it.

I know how to add new users, I know how to add new groups. I'm unsure of the best way to handle users being only able to edit some sites. I read over the answers here in this question, so I was thinking I could setup a group and add users to that group, but then they'd all have essentially the same permissions. Am I just going to have to assign each user specific permissions? Or is there a better way of handling this?

Added: I should also note, that I'll have each user login in via SSH/sFTP. The users would never need to do anything else on the server.

share|improve this question

1 Answer 1

up vote 6 down vote accepted

You should use a group for each website. And make all users that need write access to be members of the respective group.

groupadd site1_com
mkdir /var/www/www.site1.com
chgrp site1_com /var/www/www.site1.com
find /var/www/www.site1.com -type d -print0|xargs -0 chmod g=rwxs
chmod -R g+rw /var/www/www.site1.com
usermod -aG site1_com user1

Now each time the users are creating files under /var/www/www.site1.com folder they should use the umask 0002 (in ~/.bashrc or in the deployment script) or they should set the permission for the group to have read write access chmod -R g+rw /var/www/www.site1.com 2>/dev/null.

Another solution to set the permissions would be to use dnotify. Create /usr/local/sbin/dnotify_handler-reset_perms.sh script with the following content:

#! /bin/sh
CHANGED_FOLDER=$1
find $CHANGED_FOLDER -maxdepth 1 -mmin 0 -not -perm -g+w -exec chmod g+w {} \;

And add to /etc/rc.local:

dnotify --recursive /var/www/www.site1.com --create --execute --background /usr/local/sbin/dnotify_handler-reset_perms.sh
share|improve this answer
    
This is a great, full answer. Thank you very much! –  Michael T. Smith Mar 30 '10 at 14:40
    
@Mircea Vutcovici, I have open bounty for similar question , please look at this: stackoverflow.com/questions/18228351/… –  sakhunzai Aug 31 '13 at 8:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.