I have one Linux LAMP webserver (Ubuntu) with some websites on it.

They all run within the same apache2 instance and are accessible by different vhosts.

Most of them are run by myself, but I also have some friends websites hosted there.

I want and use to have separate user accounts for different websites to manage files, cronjobs etc.

The webserver runs as www-data.

Now most of the files/directories don't require write permissions by the website, but some do. I am okay with separately setting those to writable with the user I use to manage the files. In fact i prefer it that way.

However what is always bugging me a little are files that are created by the webserver. For example cache or session files. Consequently they are owned by the web-servers user and with the default permissions are not writable by the users linux user. In my case file modifications by the web servers user happyn exclusively using PHP.

Now the "best" solution for that problem that I found would be running suexec/suphp to let the php process run as the owner of the PHP file. However this comes with the big trade off of not having the advantages of apaches mod-php and a big performance loss because every php process runs over cgi. But my biggest problem would be opcode and memory caching.

Now what I think I could do is to add all the users I have to the group www-data, so that with the default permissions of 664/775 the shell user can modify files. However the shell user will then not be able to adjust chmods because he/she is not the owner, but that should not be a problem as I cannot think of a situation where this would be necessary for files/directories created by the webserver. And the webserver as owner would not need it anyway.

However I am completely new to the whole group/user/permission stuff because I used to have my own server for every project and never did anything with shared hosting.

I only know structures from plesk/confixx and similar things and know that they are always problematic.

So I am asking for the easiest approach that handles common webhosting needs to that problem.

Furthermore: How can I efficiently "jail" the user to its own directory and have it look as the top-level directory in scp/ssh? I know that it will not be entirely possible and no security must rely on it (because the user could run a php script listing other directories etc...) but that is not the motivation. The motivation is to have everything a little isolated and seperated to facilitate management purposes.

  • For the ftp part: What ftp server are your using? And for the other part: What's so wrong with the same group for all users, including the webserver? – DaDaDom Mar 2 '12 at 14:46
  • none, only openssh server – The Shurrican Mar 2 '12 at 19:22
  • So, you are not running a FTP server but you want to use FTP/SFTP? – DaDaDom Mar 4 '12 at 14:06
  • sorry, i have to correct myself on that. i don't need/want ftp/sftp. i am perfectly happy with scp. – The Shurrican Mar 6 '12 at 10:19

I don't think that there's a "nice" solution to this problem. The best is probably a cronjob which chowns the files to $user:www-data and chmods files which the webserver needs to write to to u=rwX,g=rwX,o= (and u=rwX,g=rX,o= for files which the webserver only needs to read). In terms of SSH/SCP isolation your best bet is probably file permissions. FTP/FTPS is a better solution though, because the FTP server can chroot users inside their directory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.