3

I have a server with ubuntu 14.04.

I installed apache2,php5 and pure-FTPd.

So apache is running in mpm prefork with one process owned by root and all child processes owned by www-data.

The /var/www/html is owned by root (-rw-r--r-- 1 root root)

Now I have a ftp user called ftpuser.

What would be the best way (and more secure) so that the ftpuser can create and edit files under /var/www/html ?

Can I change the group owner of /var/www/html to www-data with write access and add ftpuser to www-data group ?

If now I also want to use mediawiki, it sometimes needs write access to the /var/www/html. So same question : Can I change the group owner of /var/www/html to www-data with write access ?

3 Answers 3

2

Usually, it is a bad idea to give write access to the account running the Web Server (www-data under Ubuntu).

For your scenario, I would change the owner of /var/www/html to the ftpuser with a read-write for him, read only for the group and the others. Apache needs at least to be able to read in this directory.

UPD: If you have more than one user to give access to, put them all in the same group, change the group ownership to this group and give the group read & write access too.

Security-wise, it is a bad idea to give Apache write access to all files he can access. If someone is able to do "nasty things" with your web server, at least he won't be able to change the files using Apache directly.

Don't forget to secure the installation of the FTP server you intend to use to let ftpuser upload files.

If Mediawiki needs to write on some files, I would give to these files only the read-write rights for the www-data user (by setting the owner of these files to www-data). If you cannot predict which files need to be writable by the web application, you'd better to isolate this application into a subfolder of ´/var/www/html´.

By experience, I know that when right access is needed on some of the file, usually the documentation of the application details exactly which ones.

2
  • Thanks Benoit. And what would be your advice if I have a group called ftpgroup containing ftpuser and ftpuser2 ?
    – tweetysat
    Jun 19, 2014 at 12:53
  • @tweetysat: updated my answer with your comment.
    – Benoit
    Jun 19, 2014 at 13:02
0

The Apache2 web server is available in Ubuntu Linux. To install Apache2:

At a terminal prompt enter the following command:

sudo apt-get install apache2 

Basic Settings

If you wish to configure a new virtual host or site, copy that file into the same directory with a name you choose. For example:

sudo cp /etc/apache2/sites-available/default /etc/apache2/sites-available/mynewsite

Edit the new file to configure the new site using some of the directives described below.

2
  • 1
    Are you sure you have read my questions ?
    – tweetysat
    Jun 19, 2014 at 11:21
  • sorry if my answer is not good for you . in fact, i read very quickly -- I wanted help you, that’s all. sorry
    – Hadi
    Jun 19, 2014 at 11:23
0

If you do not already have Apache installed, you can do so now by issuing the following commands:

sudo apt-get update
sudo apt-get install apache2

This is all that is necessary to have a working web server. If you visit your VPS's IP address in a web browser, you will get the default Apache index page:

your_domain_name_or_ip_address

It works!
This is the default web page for this server.
The web server software is running but no content has been added, yet.

The Apache File Hierarchy in Ubuntu and Debian

On Ubuntu and Debian, Apache keeps its main configuration files within the "/etc/apache2" folder:

cd /etc/apache2
ls -F

apache2.conf  envvars     magic            mods-enabled/  sites-available/
conf.d/       httpd.conf  mods-available/  ports.conf     sites-enabled/

Looking at the Apache2.conf File

The main configuration details for your Apache server are held in the "/etc/apache2/apache2.conf" file.

This file is divided into three main sections: configuration for the global Apache server process, configuration for the default server, and configuration of Virtual Hosts.

In Ubuntu and Debian, the majority of the file is for global definitions, and the configuration of the default server and virtual hosts is handled at the end, by using the "Include ..." directive.

The "Include" directive allows Apache to read other configuration files into the current file at the location that the statement appears. The result is that Apache dynamically generates an overarching configuration file on startup.

If you scroll to the bottom of the file, there are a number of different "Include" statements. These load module definitions, the ports.conf document, the specific configuration files in the "conf.d/" directory, and finally, the Virtual Host definitions in the "sites-enabled/" directory.

We will focus on the first part of the file to learn how Apache defines its global settings.

I hope it works for you

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .