Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have ACL installed on my server. I maintain my web documents and PHP scripts via FTP. Some of my PHP Web Apps are designed to create/update/delete web documents and do file uploads.

Can anyone advise me on the correct SETFACL settings for my files and directories to enable me to FTP while enabling my PHP apps to perform as described above while not exposing my server to security weaknesses.

Currently, I have certain directory and file permissions set to 0777 with owner/group as "nobody".

Thank you very much for helping me out.

share|improve this question
Any ACL experts out there? – H. Ferrence Feb 15 '11 at 12:28
Ok, then...anyone that knows ACL? – H. Ferrence Feb 15 '11 at 18:35

There's an example of something I use in an answer posted at oddities in interference of linux extened ACLs and 'regular' permissions, copied here for ease of reference:

chown --recursive $username:$userrole /home/data/private/$datadir
chmod --recursive u=rwx,g=,o= /home/data/private/$datadir

# remove previous ACLs
setfacl --recursive --remove-all /home/data/private/$datadir

# User/group access for owner, group leader and web server
setfacl --recursive -m u:$username:rwx /home/data/private/$datadir
setfacl --recursive -m g:RGLeader:rx /home/data/private/$datadir
setfacl --recursive -m u:www-data:rwx /home/data/private/$datadir

# Copy access modes to default access modes
getfacl --access /home/data/private/$datadir | setfacl --recursive -d -M- /home/data/private/$datadir
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.