Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for information on best-practices and common conventions for setting up users and groups for a unix-based web server hosting multiple sites.

I'm looking for info on things like: how to securely setup your server for web developers, how to securely give apache/php access to read/write files (and what user/group should they be running), where does sudo fit in, etc.

share|improve this question
That's a rather broad request...this site tends to be for answers to specific issues. You may find more answers by researching FAQs and documentation. – Bart Silverstrim Apr 19 '11 at 14:02
up vote 1 down vote accepted

I usually set up file permissions on directories with group access in the following way:

  1. create a new group: addgroup team
  2. add users to this group: adduser user1 team
  3. create new directory: mkdir /var/www/project
  4. change group ownership for the directory: chgrp team /var/www/project
  5. change the permissions for the directory: chmod g+sw /var/www/project
  6. edit PAM config files, adding, to set umask to 002 (or 007, if you like).

More details here: How to change default `umask' in Linux. File permissions for collaborative environment

share|improve this answer
So if a file gets deleted in this setup, how do you attribute who did it? Do you have some sort of version tracking on top of this layout? – Marcin Apr 20 '11 at 12:37
Actually, this is perfect. The last piece I'm struggling with are: making sure any files users write are placed in the 'team' group and 2nd, making sure that PHP still has writable access to the files. Currently, apache and php are in apache:apache. Any help would be appreciated. – doremi Apr 20 '11 at 13:49
@Marcin: yes, all code is stored in SVN. – minaev Apr 20 '11 at 13:55
@Joshua McGinnis: The files created in the directory with setgid flag (note chmod g+sw) will belong to the group which is also the owner of the directory. As for PHP, won't it help if you add user 'apache' to 'team'? – minaev Apr 20 '11 at 13:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.