Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There are many threads about this topic but many are subjective since it's such a flexible subject, so I hope I'm asking an objective question relevant to my setup which is: is this is a sensible approach to the problem of Apache and FTP permissions.

Ubuntu 12.04 LTS 64 bit LAMP server running in Amazon's EC2; Apache2, MySQL, PHP.

Apache2 runs under www-data.

Apache2 default site disabled. Site: enabled.

sitesavailable/ configured, with DocumentRoot and the Directory directive to point to /mnt/ebs1/public_html

In order to FTP files to the above public_html directory and also be able to manage them from the terminal, I created two specific user accounts and a group:

remote-system-user remote-ftp-user group: ftp

remote-system-user is a member of the admin group so is able to perform sudo operations at the terminal, and also the ftp group. It was created with 'adduser' and has a home directory.

remote-ftp-user is only a member of the ftp group. It was created with 'useradd' and does not have a home directory.

I then set permissions on /mnt/eb1/public_html like this:

sudo chgrp -R ftp /var/www sudo chmod -R g+w /var/www

I use proFTPd as an FTP server, and using it's conf file, I jail the FTP user to /mnt/ebs1/public_html

Other than perhaps choosing a better name for the ftp group, since it's a bit illogical if the remote SSH user is also a member, what are people's comments on this setup?

The objective is to not give www-data full permissions to the public_html folder, but I will need site users to be able to upload files. I intend to create a folder within public_html which is writable by www-data to solve that issue.

Thank you

share|improve this question

I solved that trouble using same web server user, the trouble is that you wanna access using group privileges, but usually group haven't same user auth, I mean for web server files, when I was on Apache1 (I dunno if that module is available for Apache2) I used to specific the userid and the group owner for each virtualhost, that was usefull to have an ftp user for each virtual server too...

share|improve this answer
Thank you for your input! – cog1 Aug 1 '12 at 14:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.