I was hoping someone could point me in the right direction regarding Linux permissions. I understand how to calculate what permissions are, understand the methodology behind changing them and can handle the dirty work, I'm just unsure what permissions I should give for proper security.

I've been developing from root on a Linux server, with permissions set to 644 on all files (located in /var/www). As I'm taking on a new developer, I'd like to set up proper users and still be able to edit. I would not like to use version control at this time. It seems to me that by creating two new users (one for me and one for the new developer), adding us to a common dev group and changing all files group owner to that dev group, I could just chmod all files at 664 and maintain freedom to edit.

By setting the permissions as described above, are my files still (relatively) secure permissions wise?

Edit: Found a great resource here for anyone looking in the future.

  • You might want to consider asking this on ServerFault. – NickAldwin May 3 '11 at 16:52
  • 1
    @Whetstone - thanks for that great link. Two things... (1) You should never develop as root, and if you're thinking about "proper security" you should never even login as root. (2) You should always use version control, even if you're the only person on the project. It will someday save you from having to commit ritual Seppuku and you should get used to using it. – Stephen P May 3 '11 at 18:56

You should create a group "developers" and add you and the second guy to that groups. Each user can be in many groups and each group can have many users.

And then you do a chgrp -R developers /var/www ( -R means "recursive" ) and chmod -R 664 /var/www.

Or some other configuration .. you for example might want the "apache" user to be in the same group as the users .. your choice .

| improve this answer | |
  • 1
    Since this will/might cause problems when new files are created I would suggest changing the primary group for both developers and apache to "developers" and umask for everyone involved to 0002 – Fuzzy76 May 3 '12 at 10:46

If you put the group sticky bit (02775 for example) and set the group of the dir to the group that both users are in, then all new files will be created with the group of the dir, not the primary group of the user. This will make sure that all new files created will be accessible by all appropriate users, not counting umask (which you may want to change to 002 to make new files created with 664).

| improve this answer | |

I like setting the sticky bit on directories where multiple people will handle the files. I generally use version control, but on /usr/local/src I will chmod 1775 /usr/local/src. This way people will not be able to delete files they did not create.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.