Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Debian Squeeze server with an EasySCP admin panel. This panel set domain folders in /var/www/virtual/

Every domain has a unique ID of vu2000, vu2001... Ownership of the files under domain folders is vu2000:vu2000 on domain1, vu2001:vu2001 on domain2 and so on. Everything works great (apache, root access, etc.).

I need a non-root SSH/SCP user who can read and write all domain folders (recursively) under /var/www/virtual (copy, create files, etc.). Only root is able to do that, I do not want to give somebody root access because of many security risks.

Which group do I have to set for the user to be able to access and change files in domain folders? With www-data group this user can read, but cannot write. How do I set this up?

share|improve this question
up vote 2 down vote accepted

You can use ACL using setacl command

suku@ubuntu-vm:~$ ls -ld /test
drwxrwxr-x+ 2 root root 4096 Jan  4 20:55 /test

suku@ubuntu-vm:~$ sudo setfacl --recursive -m u:test:rwx /test

suku@ubuntu-vm:/test$ getfacl /test
getfacl: Removing leading '/' from absolute path names
# file: test
# owner: root
# group: root

suku@ubuntu-vm:~$ sudo su - test
test@ubuntu-vm:~$ touch /test/a

test@ubuntu-vm:~$ ls -l /test/ 
total 0
-rw-rw-r-- 1 test test 0 Jan  4 20:58 a

man page :

If you don't have setfacl command, you can install it using following in ubuntu:

sudo apt-get install acl

share|improve this answer
Thank you very much, Suku! – Caesar Jan 4 '13 at 18:15
added --recursive for making ACL rule recursive. – Suku Jan 4 '13 at 18:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.