How to avoid using sudo when working in /var/www?

Question

I want to stop having to use sudo everytime I work in /var/www. How can I do that? I simply want to put all of my sites into this directory and work with them without too much pain.

Answer 1

Most answers here are not written with security in mind. It's good to get a feeling that running sudo each time is not very wise. If you make a typo (e.g. (do not execute) sudo rm -rf / var/www/dir), you might trash your system.

Bad ideas:

• chmod 777 (sagarchalise) - this allows anyone with access to your system write into the directories and files and thereby allowing the intruder to execute any code under the www-data user
• chgrp -R www-data $HOME (cob) - this allows www-data to read or write any files in the home directory. This is not keeping the Least Privilege rule in mind
• chown -R $USER:$USER /var/www (kv1dr) - unless the world has read permissions on /var/www, the webserver running under www-data will not be able to read (serve) the files. If the file is a public-accessible plain HTML document, it might not be an issue if the world can read the file. But if the file is a PHP file containing passwords, it is.

NOTE: in the below solutions, I've granted www-data write privileges. However, /usr/share/doc/base-passwd/users-and-groups.txt.gz states:

www-data

Some web servers run as www-data. Web content should not be owned by this user, or a compromised web server would be able to rewrite a web site. Data written out by web servers will be owned by www-data.

Where possible, do not grant write permissions to the www-data group. www-data only needs to be able to read the files so the webserver can serve it. The only case where www-data needs write permissions is for directories storing uploads and other locations which needs to be written.

Solution 1

Add yourself to the www-data group and set the setgid bit on the /var/www directory so that all newly created files inherit this group as well.

sudo usermod -a -G www-data "$USER"

Correct previously created files (assuming you to be the only user of /var/www):

sudo chown -R "$USER":www-data /var/www
find /var/www -type f -exec chmod 0660 {} \;
sudo find /var/www -type d -exec chmod 2770 {} \;

(even safer: use 640 or 2750 and manually chmod g+w file-or-dir that needs to be writable by the webserver)

Solution 2

Create a symlink for each project to your home directory. Say your project is located at ~/projects/foo and you want to have it located at /var/www/foo, run:

sudo ln -sT ~/projects/foo /var/www/foo

If your home directory has no execute bit set for other for security reasons, change the group of it to www-data, but set the execute bit only (no read/write). Do the same for the ~/projects folder as it may contain other projects than www.

sudo chgrp www-data ~ ~/projects
chmod 710 ~ ~/projects

Set the group to www-data on ~/projects/foo and allow the webserver to read and write to files and files+directories and descend into directories:

sudo chgrp ~/projects/foo
find ~/projects/foo -type f -exec chmod 660 {} \;
find ~/projects/foo -type d -exec chmod 770 {} \;

(even safer: use 640 and 750 by default and manually chmod files and directories that need to be writable by the webserver user)

From now on, you can access your site at http://localhost/foo and edit your project files in ~/projects/foo.

See also

• Permissions issue: how can Apache access files in my Home directory?
• Reasons why /var/www should not have chmod 777

Answer 2

Rather than storing my web sites in /var/www I place links there to the sites which are located in my home folder. I can freely edit, or add pages to my sites. When I happy with changes I then FTP to a hosting company where my domain name links.

Answer 3

You could start a www-session in a terminal by

sudo su www-data

Combined with a differently colored prompt*, to make it more obvious that it is the shell of a different user, and a policy always to put the corresponding xterm (and editor and such) on - for example - the virtual desktop 4, so that you get used to it, to avoid confusion.

*) For a differently colored prompt with a differnt character, create a file /etc/prompt like this:

# PROMPTING
#       When  executing  interactively, bash displays the primary prompt PS1 when it is ready to read a command, and the sec-
#       ondary prompt PS2 when it needs more input to complete a command.  Bash allows these prompt strings to be  customized
#       by inserting a number of backslash-escaped special characters that are decoded as follows:
#              \a     an ASCII bell character (07)
#              \d     the date in "Weekday Month Date" format (e.g., "Tue May 26")
#              \D{format}
#                     the  format is passed to strftime(3) and the result is inserted into the prompt string; an empty format
#                     results in a locale-specific time representation.  The braces are required
#              \e     an ASCII escape character (033)
#              \h     the hostname up to the first `.'
#              \H     the hostname
#              \j     the number of jobs currently managed by the shell
#              \l     the basename of the shell's terminal device name
#              \n     newline
#              \r     carriage return
#              \s     the name of the shell, the basename of $0 (the portion following the final slash)
#              \t     the current time in 24-hour HH:MM:SS format
#              \T     the current time in 12-hour HH:MM:SS format
#              \@     the current time in 12-hour am/pm format
#              \A     the current time in 24-hour HH:MM format
#              \u     the username of the current user
#              \v     the version of bash (e.g., 2.00)
#              \V     the release of bash, version + patchelvel (e.g., 2.00.0)
#              \w     the current working directory
#              \W     the basename of the current working directory
#              \!     the history number of this command
#              \#     the command number of this command
#              \$     if the effective UID is 0, a #, otherwise a $
#              \nnn   the character corresponding to the octal number nnn
#              \\     a backslash
#              \[     begin a sequence of non-printing characters, which could be used to embed a terminal  control  sequence
#                     into the prompt
#              \]     end a sequence of non-printing characters
#
#       The  command  number and the history number are usually different: the history number of a command is its position in
#       the history list, which may include commands restored from the history file (see HISTORY below),  while  the  command
#       number  is  the  position in the sequence of commands executed during the current shell session.  After the string is
#
# colors:
# \[...\]   wird benötigt, damit die shell weiß, daß hier kein printable output ist, und die Umbrüche richtig plaziert.
#
# ANSI COLORS
CRE="\[
[K\]"
NORMAL="\[[0;39m\]"
# RED: Failure or error message
RED="\[[1;31m\]"
# GREEN: Success message
GREEN="\[[1;32m\]"
# YELLOW: Descriptions
YELLOW="\[[1;33m\]"
# BLUE: System messages
BLUE="\[[1;34m\]"
# MAGENTA: Found devices or drivers
MAGENTA="\[[1;35m\]"
# CYAN: Questions
CYAN="\[[1;36m\]"
# BOLD WHITE: Hint
WHITE="\[[1;37m\]"
#
# default:
# postgres, oracle, www-data
#
# PS1=$BLUE"machine]->"$NORMAL\\w"$BLUE ø $NORMAL"
PS1=$BLUE"machine]:"$NORMAL\\w"$BLUE > $NORMAL"
#
# root, stefan:
#
case "$UID" in
    '0')
        PS1=$RED"machine:"$NORMAL\\w"$RED # $NORMAL"
    ;;
    '1000')
    PS1=$GREEN"machine:"$BLUE\\w$YELLOW" > "$NORMAL
    ;;
#    default)
#    ;;
esac

and source it from /etc/bash.bashrc for instance.

As additional tool to help distinction, you could always edit your files with an alias 'edit' or a symlink, which points, depending on your identity (taylor/www-data) to either gedit or mousepad, vim or pico. Or you could use different editor profiles, at least in gedit you may set your preferences to black text on white ground or white text on black ground for instance.

I only have such a policy for working as root, so I'm not sure how good it will fit to working with www-data. Combined with ssh-sessions to differnt hosts, which have their own prompts, it didn't stop me from being sometimes wrong, but if it happens, I realize fast, what is wrong, and it happens rarely.

note: The prompt-script is partly a copy of the manpage of bash.

Answer 4

chmod in /var on www to allow the owner access, and chown to make sure you own it. Probably a stupid idea, but it would definitely work.

Answer 5

If you make /var/www writeable by its group and add yourself to the group, you will not have to use sudo while still being fairly secure. Try this:
sudo adduser <username> www-data
sudo chown -R www-data:www-data /var/www
sudo chmod -R g+rw /var/www
You should then be able to edit /var/www/ files without hassle.

The first line adds you to the www-data group, the second line clears up any files with messed up ownership, and the third makes it so that all users who are members of the www-data group can read and write all files in /var/www.

Answer 6

In complement of sagarchalise, I suggest you to first change your group :

sudo chgrp www-data -R /home/[YourHome]

Then by replacing /var/www by your own folder :

sudo mv /var/www /var/www.old;
sudo ln -s /home/[YourHome]/public_html /var/www;

Answer 7

The /var/www folder neads to be owned by your user. So, you have to do this: sudo chown -R yourusername:yourusername /var/www, where yourusername is your username on your computer. So, if your username is TaylorOtwell, then the command will be sudo chown -R TaylorOtwell:TaylorOtwell /var/www.

Answer 8

If you want to change the permission of a folder you can also run gksudo nautilus (opens the filemanger with root privileges), navigate to the folder and change the settings under properties permission to what you need.