Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Server: debian4 / apache2 / php5

I have a vps and i usually only run websites that I administer, so I have loaded everything up under one username.

Now I have an external developer doing some work, and would like to give them access to one of my websites, but not the rest of them.

I also thought it would be a good idea to run all the websites as separate users, so if they get hacked or something, they can't wreck the other sites on the server.

Apache is running as www-data

I have run

chown -R myusername:www-data httpdocs
chmod -R 0750 httpdocs

so now it looks like
drwxr-x---myusername www-data httpdocs

Is that the right way to go about securing this?

Thanks

alex

share|improve this question
add comment

2 Answers 2

up vote 1 down vote accepted

Yes those permissions will work fine for what you are trying to achieve.

share|improve this answer
add comment

Personally I'd use a subversion/git/mercurial (whatever floats your boat) source code repository and checkout the source regularly thru a cronjob after some sanity checks are done (automated tests to make sure the site still works)

If you want/need direct write access for a couple of people you have 2 options. I'd say it depends on wether your backup solution is capable of ACLs.

If so use ACLs to get the desired results. Your friends in this case are setfacl and getfacl.

If you can't do ACLs you should use a group that can write to that directory and make it sticky so that you won't run into a situation where userA writes a new file to the document root which userB can't modify.

share|improve this answer
    
Would you use such a setup in a production environment? SO/SF has svn revision ID at the bottom, could it indicate that it has similar setup to what you are refering here? –  Karolis T. Jun 12 '09 at 7:19
    
The SVN setup? We use it in production for a mid sized installation that runs 2 webservers. There's a very short grace period which could occur between updating ServerA and ServerB practically we didn't see any troubly by now (and the site has been running for 3+ years that way) –  Server Horror Jun 12 '09 at 7:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.