0

We have an internal server where we work on with 3 users. It is running ubuntu with apache mysql proftpd

We often have permission errors. Sometimes we can't overwrite files but we can delete them etc. What would be a good way to set this up. Who should be the owner of the files? (currently www-data:www-data).

The 3 users need to be able to delete, write and read files from the webfolders. Apache needs to have all the rights to run Joomla.

1

2 Answers 2

0

You can create a group and add all your 3 users to this group. Then, you change the group owner to this new group and grant the group full permissions chmod g+rwx.

For apache user, most of the time it requires only read access to files and read+execute access on folders. You can set the owner to www-data:www-data for some folders like upload ones which require apache user to write to them.

2
  • You should use chmod g+rwX -R <dirname> where X means only if it is a directory, but x means all files and directories. And -R means recursive.
    – Peter
    May 2, 2012 at 12:25
  • @Peter: rtfm "X ...or already has execute permission for some user"
    – symcbean
    May 2, 2012 at 14:13
0

Who should be the owner of the files?

NOT THE WEBSERVER UID!!!!

The webserver only needs read access to most of the files. There may be updateable files in specific directories depending on how Joomla is configured, but lets not worry about that just now.

Set up a group for the users whom need write access, say webdev. Then (as root):

 cd $WEBROOT
 find . -type d -exec chmod a+rx,o-w,g+ws {} \;
 find . -type f -exec chmod a+r-x,o+r-w,g+ws {} \;
 find . -exec chgrp webdev \;

Files are then readable by the webserver via 'other', writeable by the webdev via the 'group' permissions, and new files / directories will be created owned by webdev.

If you need to make specific directories writeable by the webserver uid, then chmod o+w them (and add a .htaccess file / modify the webserver config to prevent direct access by the webserver if they are inside the document root).

And please stop using FTP. It's an accident waiting to happen.

2
  • There may be updateable files in specific directories depending on how Joomla is configured, but lets not worry about that just now. with help from suPHP or Apache mpm_itk scripts can be run as the owner of the file. Of course this creates a performance hit but for most users that should do OK. May 2, 2012 at 14:18
  • There might be webserver updateable files and there will be executable files (by PHP or other). But if you've got files where this is true for both then you have no security.
    – symcbean
    May 3, 2012 at 15:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .