Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Has anyone got a nice solution for handling files in /var/www?
We're running Name Based Virtual Hosts and the apache2 user is www-data.

We've got two regular users & root. So when messing with files in /var/www ,rather than having to...

chown -R www-data:www-data  

...all the time, what's a good way of handling this?

Supplementary question. How hardcore do you then go on permissions?

This one has always been a problem in collaborative development environments.

share|improve this question
    

3 Answers 3

up vote 126 down vote accepted

Attempting to expand on @Zoredache's answer, as I give this a go myself:

  • Create a new group (www-pub) and add the users to that group

    groupadd www-pub

    usermod -a -G www-pub usera ## must use -a to append to existing groups

    usermod -a -G www-pub userb

    groups usera ## display groups for user

  • Change the ownership of everything under /var/www to root:www-pub

    chown -R root:www-pub /var/www ## -R for recursive

  • Change the permissions of all the folders to 2775

    chmod 2775 /var/www ## 2=set group id, 7=rwx for owner (root), 7=rwx for group (www-pub), 5=rx for world (including apache www-data user)

    Set group ID (SETGID) bit (2) causes the group (www-pub) to be copied to all new files/folders created in that folder. Other options are SETUID (4) to copy the user id, and STICKY (1) which I think lets only the owner delete files.

    There's a -R recursive option, but that won't discriminate between files and folders, so you have to use find, like so:

    find /var/www -type d -exec chmod 2775 {} +

  • Change all the files to 0664

    find /var/www -type f -exec chmod 0664 {} +

  • Change the umask for your users to 0002

    The umask controls the default file creation permissions, 0002 means files will have 664 and directories 775. Setting this (by editing the umask line at the bottom of /etc/profile in my case) means files created by one user will be writable by other users in the www-group without needing to chmod them.

Test all this by creating a file and directory and verifying the owner, group and permissions with ls -l.

Note: You'll need to logout/in for changes to your groups to take effect!

share|improve this answer
    
On debian lenny, in addition to Tom's post, i had to modify /root/.bashrc umask also to 0002, or www-data won't have a proper umask by just editing umask in /etc/profile . –  Trif Jun 2 '10 at 13:08
3  
@Tom Great to see that you recommend using the findcommand for this. One small performance tip I would give if you have lots of files/directories and you are using GNU find is to use + instead of \; so that the command will operate on multiple files because "it is faster to run a command on as many files as possible at a time, rather than once per file. Doing this saves on the time it takes to start up the command each time." Also, it is easier to type since it doesn't need backslash. –  aculich Feb 18 '12 at 7:46
1  
Updated with @aculich's suggestion to use + not \; –  Tom Jun 4 '12 at 23:43
1  
@SunnyJ. try this (without the outer quotes): "find /var/www -type f -exec chmod 0664 '{}' \+" Try that. There is a space between the '{}' and the \+. –  Buttle Butkus Jun 28 '12 at 6:00
1  
@Tom- way to break it down, thanks. Just a note- I think "SETUID (4) to copy the user id" as included in your answer is wrong- SETUID is ignored when applied to directories in Linux/Unix - Ref –  Yarin Dec 3 '12 at 22:00

I am not entirely how you want the permissions, but this may give you a starting point. There probably are better ways. I am assuming you want both users to be able to change anything under /var/www/

  • Create a new group (www-pub) and add the users to that group.
  • Change the ownership of everything under /var/www to root:www-pub.
  • Change the permissions of all the folders to 2775
  • Change all the files to 0664.
  • Change the umask for your users to 0002

This means any new file created by either of your users should be username:www-pub 0664 and any directory that gets created will be username:www-pub 2775. Apache will get read access to everything via the 'other users' component. The SETGID bit on the directories will force all files being created to be owned by the group that owns the folder. Adjusting the umask is needed to make sure that write bit is set so that anyone in the group will be able to edit the files.

As for how hardcore I go on permissions. It completely depends on the site/server. If there is only 1-2 editors and I just need to keep them from breaking things too badly then I will go easy. If the business required something more complex then I would set up something more complex.

share|improve this answer
1  
Possible addition - set cache/upload dirs that need to be written to by the webserver to www-data:www-data and 775. –  gacrux May 11 '09 at 12:45
    
Would it work as well to add the users to the apache group instead of relying on 'other' permissions? If all you are doing is uploading files and those files need to be readable by apache a 3rd group only seems to be useful if you need to edit those files. –  Simurr May 11 '09 at 18:49
1  
Any chance you can expand this a little @Zoredache? I grok the basic use of rwx bits, chmod, chown, adduser, usermod, but you've lost me with the extra first digit on the octal permissions, umasks and all that. Some sample commands illustrating your outlined approache would be greatly appreciated. –  Tom Sep 15 '09 at 3:24
1  
This way every user can access every other user files ! This means userA can read config.php of userB ... stoling its mysql credential, for example –  AlberT May 9 '11 at 12:02
1  
Using acl you can handle both security and collaborative-ness :) –  AlberT May 10 '11 at 14:19

I think you may find POSIX ACL (access control lists) to be helpful. They allow a finer-grained permission model compared to the user:group:other model. I have found them to be easier to keep straight in my head since I can be more explicit and can also set the "default" behavior for a branch of the file system.

For example, you can specify each user's permissions explicitly:

setfacl -Rm d:u:userA:rwX,u:userA:rwX /var/www
setfacl -Rm d:u:userB:rwX,u:userB:rwX /var/www

Or you can do it based on some shared group:

setfacl -Rm d:g:groupA:rwX,u:groupA:rwX /var/www

And perhaps you want to keep your Apache user as read-only

setfacl -Rm d:u:www-data:rX,u:www-data:rX /var/www

Man pages:

Tutorial

share|improve this answer
2  
That's the way ! +1 –  AlberT May 9 '11 at 16:53
    
ACL for the win +1... For more see serverfault.com/a/360120/41823 –  Yarin Dec 17 '12 at 0:14
1  
I wonder if there's any performance downside for ACL vs basic permissions. –  Buttle Butkus Jan 9 '13 at 9:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.