How do I mange permissions for multiple users editing the same code on my server?

Question

I have a server that a few different coders will be using to work on various websites. Each coder will need to have access to each website.

There's two 'clean' methods I've come up with to do this but I'd rather avoid them...

1. Each website is given it's own user/group to be owned by. The website would be stored in /home/username/www/ and I'll use Apache's suEXEC to switch between users/virtual hosts.

2. I create one user/group on the system which each coder uses to login as. Websites can then be stored in /var/www/website.com/ and Apache will run as that user to have read/write access to the files

The obvious security benefits to point 1 is that each website is sandboxes. If one site is compromised, the other sites should be safe. The downside to this method is having multiple usernames/passwords for each coder to remember.

Point 2 means each coder has one login (the same login...) and there's less clutter (50 websites on the host means 50 new users/groups)

My ideal setup was to give each coder their own user/group. This would give them their own ~ folder for storing their stuff and, if I need to revoke a coder's access, I'd simply disable their login. This beats having to change the password for each website/coder's account.

The reason I can't rely on a version control system is that it'll rarely be used. A lot of the sites on this host will be using Joomla/Wordpress/etc.

So I'm basically looking for a clean and secure way for multiple coders to work on multiple, shared websites on the one host. What do you suggest?

Answer 1

Allowing multiple people to edit production code is asking for a world of hurt. Use version control and deploy only tagged builds.

How you deploy build is not nearly as important as tracking the changes and being able to back out.

Answer 2

While I agree that version control is a fantastic option, you can pull off what your asking for by doing the following (again, pay special attention to the concerns listed about version control).

So here's an answer to your Question:

Create two users and give them the same group id

 #groupadd -g 5000 programmers
 #useradd ren
 #useradd stimpy

Edit your /etc/passwd file and change your guid for your two users:

 ren:x:505:5000::/home/ren:/bin/bash
 stimpy:x:506:5000::/home/stimpy:/bin/bash

Next, change the umask for these users so that they create all their file with rw for the group programmers

 #vi /home/ren/.bash_profile
 umask 002

Now, su to each user to see that they can both edit the same files going forward:

 #su - ren
 #vi /path/to/file.txt
 here's some content in the file

 #exit

 #su - stimpy
 #vi /path/to/file.txt
 append some more content

You'll find that when ren created the file, the ownership was ren:programmers with rw-rw-r. This will allow stimpy to also edit the file. You'll also be able to keep track of how originally create the file (but not who edited it).