2

When enabling userdirs (i.e. ~/public_html) in apache, what is the standard way to set up ownership and permissions of my public_html directory? Ideally I would like to give the apache server permission to do whatever it wants in that directory without making the whole thing world-writable. Is there a standard way to do this?

If the solution involves setting specific ownership or permissions, how can I ensure that any new files created in that directory will automatically receive the appropriate permissions?

3

Typically on a multi-user system you would simply set the directory executable and leave all files within the directory public readable.

If you run the server yourself, you will have the ability to set the group to the same group as the Apache group and set the directory group writable. Additionally, you would want to SGID, so as that anything created within the directory inherits ownership.

chmod 2771 /path/to/public_html/incoming

  • That doesn't seem to work. I tried chmod 2771 ~/public_html, but then files created inside don't get put in the www-data group. – Ryan Thompson Aug 7 '10 at 17:54
  • 1
    The directory has to have www-data group membership. – Warner Aug 8 '10 at 1:49
  • Oops, I only chgrp'ed the contents, not the dir itself. – Ryan Thompson Aug 9 '10 at 5:08
1

If ACLs are available, the putting the following in /etc/cron.daily/public_html will make sure that the www-data system user has full access to all public_html folders:

#!/bin/sh

HOME_DIR="/home"
WWW_DIRNAME="public_html"
WWW_USER="www-data"

setfacl -Rm "u:${WWW_USER}:rwX,d:u:${WWW_USER}:rwX" "$HOME_DIR/*/$WWW_DIRNAME"

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.