The user wants to let PHP write files in his /home/ directory, he is advising me to do
usermod -a -G www-data username where
username is his username. I wasn't sure if this was a security issue or not.
What is the best way approaching this?
migrated from superuser.com Aug 31 '10 at 21:27
This question came from our site for computer enthusiasts and power users.
The proposed command adds the user to the
For example, suppose two users make this request and get added to the
Access control lists look a lot more appropriate for the stated purpose. This requires that your operating system and filesystem support ACLs. On Linux, make sure that the filesystem is mounted with the
Still, this problem sounds like something many people running web servers have faced before. So there may be a much better solution involving the Apache toolbox.
This is not a good idea because the user www-data will be in the group of the user. So the webserver may manipulate all files of this user.
Also, any other users on the system are then able to read and write from the files of the given user via a simple php script.
It's generally not a good idea to give the webserver more write/read access, than needed. So you might want to widen the permissions only in the directory (or even on the file) which needs write access. This can be an upload directory, for example.