To allow write access to Apache, I needed to chown www-data:www-data /var/www/mysite/uploads to my site's upload folder. This allows me to delete files from the folder via unlink() in a PHP script.

Unfortunately, this prevents another PHP script, which uses FTP functions, from working. I think it is because the FTP user is mike and now that the uploads directory is owned by www-data, mike cannot access it.

I added mike to the group www-data, but this does not fix the issue.

Can somebody advise me on how to allow PHP FTP functions to work in addition to file deletion using PHP's unlink() function?

  • what's the group permissions on /var/www/mysite/uploads set to? – Zypher May 19 '10 at 21:11
  • @Zypher: Group permissions for /var/www/mysite/uploads are r-s – Mike Moore May 19 '10 at 21:13
  • @letseatfood and in /var/www/mysite? – jneves May 19 '10 at 23:38
  • @jneves Group permissions for /var/www/mysite are r-s – Mike Moore May 20 '10 at 0:20

That would be why, you need the 'write' permission to delete files. You have a couple of options here.

  1. chwon /var/www/mysite/uploads to www-data:mike and chmod to 775 (rwxrwxr-x)
  2. Create an ftp-write group and chown /var/www/mysite/uploads to www-data:ftp-write and chmod to 775
  3. just chmod to 775 (rwxrwxr-x) and leave mike as part of the www-data group
  4. set an acl on the folder for mike with setfacl -m user:mike:rwx
  5. Create an ftp-write group, add mike and the group (as well as any other users that need these permissions with setfacl -m group:<ftp_group>:rwx
  • #3 worked (chmod 775 /var/www/mysite/uploads and leaving mike in the group www-data). Is this an okay solution? – Mike Moore May 20 '10 at 0:23
  • @letseatfood: yep perfectly acceptable :) I listed them in no particular order. – Zypher May 20 '10 at 0:25

Filesystem permissions should be enough to fix your problem there. Try something like chmod o+rw on the uploads directory ONLY. The chmod command effectively says "give anyone that's not in the www-data group read and write permissions."

The longterm fix, though, would be to use a service account for your script that calls FTP, and to bundle that particular service account with www-data.

  • You don't want to be giving the "other" set o permissions more rights than you need to, chmod'ing the group is sufficient and opens less security risks. – Zypher May 19 '10 at 23:51
  • Would you elaborate about the longterm fix that you mentioned? – Mike Moore May 20 '10 at 0:23
  • Oh, do you mean that I should create a user specifically for FTP that is in the group www-data? – Mike Moore May 20 '10 at 5:36
  • yes, that is the correct way to do so – Tony May 21 '10 at 23:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.