Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Many PHP applications do self-configuration and self-updating. This requires apache to have write access to the PHP files. While chgrp'ing them all to www-data appears like a good practice to avoid making them world writable, I also wish to allow users to create new files and edit existing one.

Is adding users to the group www-data safe on Debian? For example:

775 root www-data /var/www
644 john www-data /var/www/johns_php_application.php
660 john www-data /var/www/johns_php_applications_configuration_file
share|improve this question
up vote 3 down vote accepted

I usually create a group called "webdev" and add my web developer user and www-data to the group and give it the appropriate permissions for the site/directory/files, etc.

share|improve this answer
Good idea, i did not think of going the other way around. Adding the httpd to the developer's group is more logical then the developers in the httpd's group. Thank you. – John Jul 26 '10 at 15:37

Why not use mod_userdir?

share|improve this answer
mod_userdir dont setuid or setgid apache to the user. Files are still not writable unless they are chmod'ed 777. – John Jul 26 '10 at 14:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.