Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a websites that should be completely accessible for Apache(www-data user) and I have an ftp user(that has the same username on the server: user1) that should be able to update the website.

I need the user to be able to add files to the website directory, but the www-data should have a full access to the added files.

user1 is a member of www-data group.

For now when user1 uploads file to the server the file has a rights: 644, but I need 664.

How I could organise it.

Many thanks

share|improve this question

migrated from stackoverflow.com Nov 20 '11 at 0:04

This question came from our site for professional and enthusiast programmers.

    
possible duplicate of FTP and Apache permission issues –  quanta Nov 20 '11 at 0:45
add comment

1 Answer

up vote 2 down vote accepted

The best way to fix this is to avoid using standard unix permissions as enforcement.

The following four commands should resolve this:

setfacl -d -m apache:rwx -R /path/to/shared/folder
setfacl -d -m user1:rwx -R /path/to/shared/folder
setfacl -m apache:rwx -R /path/to/shared/folder
setfacl -m user1:rwx -R /path/to/shared/folder

This alters the behaviour of the file using POSIX ACLS so that both your FTP user and apache can alter / remove / create files inside of that directory regardless of who the orginal author was.

ACL masks are defined by the standard unix bits for group. ACLs can tell a directory is a diretory as it inevitably has a +x in it. A file will typically not so even if you have an ACL set as rwx inside of it the +x part will be masked by the group permission bit not being set.

Another way is to use suPHP, suExec or some other 'change user on execution of program' method. But personally I find those methods less convenient than this.

share|improve this answer
    
Thank you very much for your advice! –  andrii Nov 21 '11 at 14:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.