Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have an internal server where we work on with 3 users. It is running ubuntu with apache mysql proftpd

We often have permission errors. Sometimes we can't overwrite files but we can delete them etc. What would be a good way to set this up. Who should be the owner of the files? (currently www-data:www-data).

The 3 users need to be able to delete, write and read files from the webfolders. Apache needs to have all the rights to run Joomla.

share|improve this question

2 Answers 2

You can create a group and add all your 3 users to this group. Then, you change the group owner to this new group and grant the group full permissions chmod g+rwx.

For apache user, most of the time it requires only read access to files and read+execute access on folders. You can set the owner to www-data:www-data for some folders like upload ones which require apache user to write to them.

share|improve this answer
    
You should use chmod g+rwX -R <dirname> where X means only if it is a directory, but x means all files and directories. And -R means recursive. –  Peter May 2 '12 at 12:25
    
@Peter: rtfm "X ...or already has execute permission for some user" –  symcbean May 2 '12 at 14:13

Who should be the owner of the files?

NOT THE WEBSERVER UID!!!!

The webserver only needs read access to most of the files. There may be updateable files in specific directories depending on how Joomla is configured, but lets not worry about that just now.

Set up a group for the users whom need write access, say webdev. Then (as root):

 cd $WEBROOT
 find . -type d -exec chmod a+rx,o-w,g+ws {} \;
 find . -type f -exec chmod a+r-x,o+r-w,g+ws {} \;
 find . -exec chgrp webdev \;

Files are then readable by the webserver via 'other', writeable by the webdev via the 'group' permissions, and new files / directories will be created owned by webdev.

If you need to make specific directories writeable by the webserver uid, then chmod o+w them (and add a .htaccess file / modify the webserver config to prevent direct access by the webserver if they are inside the document root).

And please stop using FTP. It's an accident waiting to happen.

share|improve this answer
    
There may be updateable files in specific directories depending on how Joomla is configured, but lets not worry about that just now. with help from suPHP or Apache mpm_itk scripts can be run as the owner of the file. Of course this creates a performance hit but for most users that should do OK. –  Janne Pikkarainen May 2 '12 at 14:18
    
There might be webserver updateable files and there will be executable files (by PHP or other). But if you've got files where this is true for both then you have no security. –  symcbean May 3 '12 at 15:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.