For a simple LAMP setup, what's the most secure way to handle file ownership of the /var/www directory (or sub-directories)?

Apache runs as www-data, so if it's the owner it will have write access. This is probably a bad idea, however makes it convenient for file uploads.

If they are owned by root, are there any security issues involved?

Does it make sense to have each user be the owner of their /var/www/site folder? (I realize that ~/public_html is the right way to do this, however having all web content under /var/www/ makes it easy to see what sites are currently running on the server)

3 Answers 3


There should be no issues with the contents being owned by root provided that they are readable by the httpd user.

User stuff should go under /srv, not /var/www. They can own their code and data under there.


Your security concern level depends on whether this is intranet or Internet facing (though 'safer in intranet' may be misleading depending on your firewall and overall net security).

Having the apache user have write access to the files is bad for security. If the server is rooted, then they can change content. Of course, you allowing file uploads with no vetting is a much bigger security issue - no apache hole needed. You're better off with upload to some directory out of webserver, wait to vet, move to webserver area.

If files are owned by root, then only the root user can modify them. That means all processes changing them need to be root, which is a security concern. Are you willing to give root/sudo to all web content authors? I'd recommend against this.

If possible, apache and its logs should be on a separate volume, at least off of /bin/ and /var. Overgrown logfiles or huge uploaded files can cause Denial Of Service for your OS - Linux systems act weird with 100% full /var partitions.

If you're going full LAMP with users, then you have to worry about the coding skills of your users. Make PHP secure as possible (sigh, why isn't there a better language, PHP really is horrible, but there's nothing remotely as good as it for quick content). Compile only DB access that uses parameterized queries (eliminates almost all sql injection attacks). Design your schema and authorizations in MySQL so you isolate all the users.


I am utilizing group permissions in a similar situation:

  • There is a dedicated user and group for each website

  • All files and directories supposed to be read by Apache are owner-writable and group-readable (umask is set to 027) and belong to the respective website group

  • The unprivileged Apache user www-data is a member of each website's group

  • The directories and files that are managed by website admins (web content) are owned by the respective user

  • Everything managed by server admins: web apps, CGI scripts, SSL certificates, etc., is placed in separate directories and owned by root. The Alias and ScriptAlias directives are used to access them.

  • The directories to which CGI scripts and web apps must have write access are owned by www-data and the respective website group and have the setgid bit set (chmod g+s). As a result, files created in them belong to the website group, not www-data, and can be read by the website admin.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .