Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a website running on Apache under Linux in the directory /var/www.

This site has some files outside the web directory root in /var/www-store which are written to and read by the apache user www-data.

I need another user to have read and write access to a subdirectory of this filestore /var/www-store/sync but for security reasons I don't want them to be able to access (read or write) to any files outside of this directory or anywhere else on the filesystem.

Additionally the files written by this user need to be writeable by the apache user and visa versa.

Can someone help with the permissions I need to set on this user and these directories to provide the security detailed above.

share|improve this question

3 Answers 3

up vote 1 down vote accepted

You could set group ownership on the directory and it's files you want to share with the user and not anywhere else on the filesystem?

chown -R apache:[user-name-here] /var/www-store/sync/*

That would recursively set group ownership on the directory. apache would be the owner and your user would be a group owner so you would need to make sure the directory and file can be read and written to:

chmod ug+rw /var/www-store/sync/*

The above line would allow the user and group owner to read and write to the directory.

You then need to make sure that the parent directory doesn't also have read or write permissions set for all users. That can also be done using chmod:

chmod o-rw /var/www-store/

Notice that the above line isn't recursive, or it would affect the permissinso set earlier. That should be all you need and if not it would at least get you started. Disclaimer: I haven't actually tried this so I can't say for definite it will work but if not chmod and chown should get you part of the way there. If you're doing this for security reasons you probably want to test this thoroughly on another directory as well, probably best to make one specifically for testing.

share|improve this answer
    
Loftx - Did this solve your problem? If so could you mark it as answered or let me know if there's anything else I can do to try and help. –  Bendihossan May 18 '11 at 15:40

You could add the other user to a group. And then give that group read and write access to directory /var/www-store/sync.

chown -R www-data:somegroup /var/www-store/sync
chmod -R 770 /var/www-store/sync
share|improve this answer

If the user doesn't need a physical TTY, you can try creating an sftp-only user, and configure the ChrootDirectory of OpenSSH for the user's group.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.