I'm new to Linux systems administration (dealing with users and groups) but I do have a lot of command line experience as a developer. Right now, i'm trying to make sure that three users I've added to my Debian server under the group www-data have the appropriate and expected permissions. The goal is to have all the directories in /var/www/html/ as www-data:www-data (I think that's what I want at least...I'm doing this so i don't have mixed permissions between things created under root and www-data).

I added my three new users to the sudoers file with the ALL option (the same as root).

I don't know how to think of the users now though and I need some guidance in this.

For instance, when I login as developer1 and issue the command mkdir it tells me I don't have the appropriate permission to do this. So I sudo and type in the password for my user and then mkdir test...and it shows as a dir with root as the owner and root as the group.

How can I make developer1 a user that can create directories with www-data as owner and group? Is this the right way to approach this?



The reason why your sudo-created directories are owned by root:root is because sudo literally lets you run commands as a different user, in this case as root (since you did not specify a different username).

Put developer1 into the group www-data, then make sure the directory you want this user to create files/directories in is owned by the group www-data and is writable by said group.

Now developer1 can create files and directories in there, because his group memberships let him do this.

But you'll then notice that these new directories/files are owned by developer1:developer1 (or, alternatively, developer1:users or something like that). To fix this, you can make developer1's primary group www-data, in which case everything he creates will be owned by the www-data group.

If your goal is to have this user create files elsewhere in a different group (e.g. users or developers), but create them as www-data in e.g. /var/www, well, that's one thing I've not yet figured out. So far, I've been stuck with one of two (well, three, really: the third is to just live with it) workarounds:

  1. Have the user(s) manually chgrp files and directories when they are created. Can be done recursively and/or in a batch, so you can e.g. upload a huge number of files and then chgrp them all at once.
  2. Set up a cron job that runs every so often (e.g. every 5-10 minutes) and recursively chgrps everything under your web root (or whatever it is you're trying to control) to www-data. Alternatively, you can use this cron job to chown -R www-data:www-data /var/www to ensure that the files/directories all belong to the www-data user as well as the www-data group.

I realize neither of these is ideal, although once a file is created it will retain its ownership no matter who edits it.

  • 2
    With regards to your last goal, if the filesystem is local, you should look into using ACLs, which permit setting default groups for files created inside specific directories. The ACL syntax is unfortunately complex, but take a look at setfacl(1). – justarobert Apr 8 '11 at 23:37
  • You may not want your web root writable by www-data. This allows anyone who cracks your web server to deface your site, or add malware to it. – BillThor Apr 9 '11 at 2:42

This should work:

# chown -R www-data.www-data /var/www/html
# find /var/www/html -type d -print0 | xargs -0 chmod g+s
# useradd developer1 -G www-data
# useradd developer2 -G www-data

What's happening is setgid and groups. Setgid allows all files and directories created under /var/www/html to be owned by the current group (in this case www-data). By adding the developer accounts to the www-data group, you're ensuring they have write permission.

You may run into further issues if developers are copying files into the directory without group write permissions but those can be fixed manually with chmod by the owner.

  • 1
    ACLs will also handle default permissions for files created inside those directories. – justarobert Apr 10 '11 at 19:33
  • For newly created files, default ACLs work great. I've found POSIX default ACLs work for all but one case: If a file that does not have group write set is copied into the directory, the ACL mask will make the effective permissions "r-x" for group – rthomson Apr 10 '11 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.