up vote 0 down vote favorite
share [g+] share [fb]

I'm in charge of administering a WWW linux server at work.

I have a team of web developers which need to work on a specific directory (let's say /var/www/website). Every developer should be able to read/write every file in this directory. They connect to the server using a SFTP client.

Every developer is part of the "webdevelopers" group, has the home directory pointing to "/var/www/website" and a "/bin/false" shell. Then, to increase the security, I've set up a SFTP chroot in the sshd server:

Subsystem webdevelopers internal-sftp
Match Group webdevelopers
    ChrootDirectory %h
    ForceCommand internal-sftp
    AllowTcpForwarding no

This work well, except that if a developer create a file, another developer is not able to write it.

The permission on the directory they need to work on is 644 for files and 755 for the directories. This server is facing the internet, so 777 permissions are not a solution.

How can I allow those people to work on these directory without messing up the above permissions?

link|improve this question
1  
Do you trust your work collegues? If not that is a sad state of affairs. Is it a live system that you are spraffing about? If not why worry so much and give then a bit of slack! Bottom note trust the people that you work with and sometimes they mess up - we all do once in a while - it is called being human -you will in the future and I hope they give you a bit of slack. One of my collegues messed up maajor league big style and I told him to go home. I fixed it. Lateer that year I f**k ed up. He returned the complement. Just a little lesson from an old fart. – Ed Heal Dec 14 '11 at 10:45
1  
Have you considered a revision control system? That way everyone can check in changes securely, the changes can be visible immediately if you like, and you can always go back if there's a problem. – Kerrek SB Dec 14 '11 at 10:53
@EdHeal I understand your point of view, but It's not about trust, it's about security. Whe are talking about our corporate website. Most of them just put 777 permission "because it works". I'm the sysadmin so, if the site get defaced, it's my fault, not theirs. Thanks BTW. For KerrekSB: that's a good idea actually, but the devs asked me an SFTP access – Matteo Dec 14 '11 at 11:08
@Matteo: If you don't have a version control setup in place, that should be your absolute first order of business before allowing devs access to your code-base. Also, I've never worked at a shop that used SFTP, it's all been SSH. – Mike Purcell Dec 15 '11 at 2:05
feedback

migrated from stackoverflow.com Dec 15 '11 at 1:42

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 1 down vote

If all devs are member groups, why don't you make files 664 and directories 775?

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard