On a private server with an application that needs write access (Wordpress), is it better to add Apache's web user (www-data) to the "developers" group that owns /var/www or use fastcgi / suphp instead to escalate privileges?

Note: the only users in the "developers" group are admins. Permissions would need to be 775 for folders and 664 for files if the group solution (above) is used.


You do NOT want to give apache more privileges. Figure out the minimal set of directories that apache needs write access to, give it access to those directories, then try to limit what apache is willing to do with those directories. If it is an images directory which you want wordpress to be able to add images to, the apache server shouldn't be willing to run php scripts from that directory, just serve static images. Here's one thing you want to prevent: somehow a wrong-doer gets access to a wordpress login, they upload something which is supposed to be an image, but is actually a php script. You don't want them to be able to then go to http://yoursite.com/wp-images/bad.gif and have apache actually run that as a php script (because now they get to upload arbitrary code to your server and get your server to run that code).

If you are trying to decide if developers should be added to the www-data group or the other way around, think of it this way. The developers are the people you trust to run code on your site. The www-data group is the privileges given to people who figure out a way to exploit hole in wordpress/apache/whatever else. You don't want to give these people the access you give a trusted developer. You should have no problem giving your trusted developer the rights you are willing to give to someone who has compromised your wordpress install. So add developers to www-data but don't add www-data to developers.

  • Thanks for your answer. What do you propose for when an application needs write access for certain files/folders (e.g. an uploads directory)? Assume I want to leave my ownership as root:developers. – Trent Scott Apr 10 '12 at 3:47
  • why do you want the folder to be owned by root? – stew Apr 10 '12 at 14:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.