Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server running multiple websites, with each website configured as a separate vhost. Some trusted users require shell access to the web server, but in an effort to prevent abuse and accidental misconfiguration, each user is only allowed write access to their own website directory. The way in which this is currently implemented is that each website has the ownership set to username:apache where 'username' is the username of the person who is allowed write access to the directory, and 'apache' is the group name to which the actual Apache user belongs.

This configuration works, to an extent. Users are able to edit existing files and create new files without any problems. However, since most of the sites are driven by various CMS software, all content written to the directory by the CMS (ie. the webserver / Apache) is written as apache:apache, and the user does not receive write access to the new files.

My questions:

  1. What is the best way to set up such a configuration whereby multiple users are allowed write access to their own directories only, and whereby files written by the webserver are also writable by the user?
  2. Is it possible to instruct Apache to write data for certain vhosts as another user and group?
share|improve this question
up vote 3 down vote accepted

Take a look at apache2-mpm-itk and/or suPHP.

share|improve this answer
+1 for suPHP; vastly flexible, can do almost anything you'd want around wrapping cgi execution. – Jeff Albert Jun 10 '11 at 17:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.