I mean allowing a user to modify the web files in the server. Should I change the ownership of the www directory to a certain user, or put it in a new group and give write permission, or something else? What would be the best/safest thing to do?
1 Answer
Depends on the situation, and your needs..
If the webserver does NOT need write access, and only ONE user does need write access:
That one user should own the document root. The webserver only needs read access to it. So, for instance, if the user is webmaster
and the webserver is part of group www-data
you could have the ownership be webmaster:www-data
and only allow write access to the owner, but read access to the group.
If the webserver DOES need write access, and only ONE user needs write access:
Modify the above to allow write access for the group as well.
If MULTIPLE users need write access:
You'll need some method of tracking who updated what, and possibly rolling back changes. Perhaps some of those users can commit updates, perhaps others need approval to do so. Subversion (SVN) is (IMHO) the way to go.