I could not find out what is the best way to setup your web files under UNIX OS.

I have Apache running on Centos OS, I put my root directory under /var/www/html

Here is the example:

/var/www/html         750         ssh-user       apache
  /project_a          750         ssh-user       apache
    /normal_folder    750         ssh-user       apache
    /upload_folder    770         ssh-user       apache
  /project_b          750         ssh-user       apache

I setup full control to the owner (ssh-user) and only read access to group users (apache group). For upload folder, I setup 770 which group users able to write stuff inside.

What is ssh-user? This is the same user who I use to login using SSH.

These settings are fine but sometime I got annoyed because I need to re-set the file permission by doing

chmod 750 -R project_a
chown ssh-user:apache project_a

Everytime I create new file/upload using FTP, I need to execute those commands.

So my questions:
- is my file ownership correctly setup?
- how about file permission?
- do you use any tools to manage this file permission? I heard facl may do this elegantly
- anybody used capistrano? any hint for the file permission and ownership?

Thanks guys!


is my file ownership correctly setup? / how about file permission?

We can't tell you that - it depends on your policy. But I wouldn't have gone with this model because it does not allow for multiple users to manage files. But if that's not a consideration for you, then it may be a reasonable approach.

If you're having to change permissions then presumably 'apache' is not the primary group for ssh-user. You could try 'sg apache' before changing any files or you could just set the sticky bit on the directories (forces new files to be created with the group ownership of the directory) e.g.

chown -r ssh-user:apache project_a
chmod -R g+s project_a

I heard facl may do this elegantly

I've seen too many messes created using ACLs to recommend them for use in filesystem permissions.

However a simpler solution might be to just set the files and directories as readable by 'others' (including apache) and not worry about the group ownership.

Its also worth checking whether your FTP server allows you to change your umask.

Better yet, don't use FTP.

| improve this answer | |
  • may I know how you normally setup file and folder permission? something similar to what I posted as question would be nice. – kororo Nov 5 '10 at 3:17
  • -rw-rw-r-- (any uid in webdev group) (webdev group) for files – symcbean Nov 5 '10 at 9:18
  • drwxrwsr-x (any uid in webdev group) (webdev group) for dirs (apache uid is not in webdev group) – symcbean Nov 5 '10 at 9:19

If you write / modify file upload scripts such that they set appropriate permissions like 777 or 750 then it may solve problem.

We had issue where file uploads where getting created with apache:apache and hence users were not able to delete move files if they were logged in using SSH. To solve the problem we modified upload scripts so that they also change permissions of file after upload to 777 so that users who use SSH can modify/delete/move the files.

All this is off course that you have a very trusted environment otherwise 777 permissions are very bad choice.

| improve this answer | |
  • yep I agree, 777 is bad way to do. – kororo Nov 5 '10 at 3:18

I would add my user and any other users that need to manage "web" files to the apache or www-data group. (This depends on your distro.) Then make sure that group has write access to the files/dirs.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.