The user wants to let PHP write files in his /home/ directory, he is advising me to do
usermod -a -G www-data username where
username is his username. I wasn't sure if this was a security issue or not.
What is the best way approaching this?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
The proposed command adds the user to the
www-data group. This may give him unintended extra permissions, in particular he'll be able to access any file that's restricted to the
www-data group. This is probably a lot more than you intended.
For example, suppose two users make this request and get added to the
www-data group, and each user opens up
~/www-shared to the
www-data group. Then each will be able to read and write to the other's
Access control lists look a lot more appropriate for the stated purpose. This requires that your operating system and filesystem support ACLs. On Linux, make sure that the filesystem is mounted with the
acl option. Then the user can run
setfacl -m user:www-data:rwx ~/www-shared to share a directory with the
Still, this problem sounds like something many people running web servers have faced before. So there may be a much better solution involving the Apache toolbox.
This is not a good idea because the user www-data will be in the group of the user. So the webserver may manipulate all files of this user.
Also, any other users on the system are then able to read and write from the files of the given user via a simple php script.
It's generally not a good idea to give the webserver more write/read access, than needed. So you might want to widen the permissions only in the directory (or even on the file) which needs write access. This can be an upload directory, for example.
chgrp www-data /home/foobar/public_html/wordpress/uploads chmod -R g+rwX /home/foobar/public_html/wordpress/uploads