4

I was hoping someone could point me in the right direction regarding Linux permissions. I understand how to calculate what permissions are, understand the methodology behind changing them and can handle the dirty work, I'm just unsure what permissions I should give for proper security.

I've been developing from root on a Linux server, with permissions set to 644 on all files (located in /var/www). As I'm taking on a new developer, I'd like to set up proper users and still be able to edit. I would not like to use version control at this time. It seems to me that by creating two new users (one for me and one for the new developer), adding us to a common dev group and changing all files group owner to that dev group, I could just chmod all files at 664 and maintain freedom to edit.

By setting the permissions as described above, are my files still (relatively) secure permissions wise?

Edit: Found a great resource here for anyone looking in the future.

2
  • You might want to consider asking this on ServerFault.
    – NickAldwin
    May 3, 2011 at 16:52
  • 1
    @Whetstone - thanks for that great link. Two things... (1) You should never develop as root, and if you're thinking about "proper security" you should never even login as root. (2) You should always use version control, even if you're the only person on the project. It will someday save you from having to commit ritual Seppuku and you should get used to using it.
    – Stephen P
    May 3, 2011 at 18:56

3 Answers 3

3

You should create a group "developers" and add you and the second guy to that groups. Each user can be in many groups and each group can have many users.

And then you do a chgrp -R developers /var/www ( -R means "recursive" ) and chmod -R 664 /var/www.

Or some other configuration .. you for example might want the "apache" user to be in the same group as the users .. your choice .

1
  • 1
    Since this will/might cause problems when new files are created I would suggest changing the primary group for both developers and apache to "developers" and umask for everyone involved to 0002
    – Fuzzy76
    May 3, 2012 at 10:46
3

If you put the group sticky bit (02775 for example) and set the group of the dir to the group that both users are in, then all new files will be created with the group of the dir, not the primary group of the user. This will make sure that all new files created will be accessible by all appropriate users, not counting umask (which you may want to change to 002 to make new files created with 664).

2

I like setting the sticky bit on directories where multiple people will handle the files. I generally use version control, but on /usr/local/src I will chmod 1775 /usr/local/src. This way people will not be able to delete files they did not create.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .