Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
How should I structure my users/groups/permissions for a web server?

I've seen a few answers to this on the internet, but I'm looking for a definitive answer. I have a new Ubuntu 12.04 LTS server with LAMP. Apache is set to run as "www-data" and /var/www is set as having "root" as the owner and "root" as the group. The permissions for /var/www are "drwxr-xr-x" which I believe translates to 755 numerically.

I know that /var/www should not be owned by "www-data" because then buggy/malicious code could have a field day. However, should I keep it as root:root (inconvenient) or should I change it to ubuntu:ubuntu, the default user that Ubuntu preconfigures for you to log in with? Should the permissions remain at 755?

I've been administrating systems for a while with no big security issues, but I'm trying to get really serious about security, double-check everything, and make sure that there are no gaps in my knowledge.

share|improve this question

marked as duplicate by mdpc, voretaq7 Jul 10 '12 at 21:10

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

This is pretty abstract, and it depends entirely on the application and its filesystem usage patterns. – Joel E Salas Jul 10 '12 at 19:53
Is this a read-only environment? Do your want to use ACLs? – Nils Jul 10 '12 at 20:58

We really can't answer this question - it depends on your environment.
The major concern here is someone uploading, for example, a PHP script that does malicious things to a directory they can browse to, and getting your web server to run that code by browsing to the script they just uploaded.

The best answer you can get is "A user that makes sense, preferably not the same one the web server runs as unless you have a good reason and have taken appropriate steps to ensure security."

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.