2

For security reasons I would like to disable root access via ssh.

I created a new user (user1) with administrative permissions.

adduser user1
usermod -aG sudo user1

and assigned the /www directory to this user.

sudo chown -R $USER:$USER /var/www/
sudo chmod -R 755 /var/www

(My folders structure is www/site1.com, www/site2.com, etc.)

My sites need to write some files (such as sitemaps, rss feeds, etc.) so I set the permissions of the www directory to:

sudo chown -R www-data:www-data /var/www
sudo chmod -R 755 /var/www

Now, however, user user1 works perfectly via shell with the sudo command, but can no longer add/edit/delete files and folders in the /www directory and its subdirectories via sftp.

I read many guides, how to set up apache permissions to increase security, to share administration with other users, etc. etc. etc.

But I still did not understand how to solve my problem.

Currently to be able to handle files on my server via sftp I have to use the root user, with peace of mind for security.

Did I miss something about setting user or folders permissions?

3

It's possible to set different group and user access for files and directories, and this will allow both Apache and your user1 user to edit what's in /var/www without requiring root/sudo and without making anything world-writable.

So, set the "user" permission inside /var/www to user1. Set the "group" permission to www-data (but ONLY for the specific files or directories that the web server needs to write to).

sudo chown -R user1:user1 /var/www
sudo chgrp www-data /var/www/specific-file

You should avoid letting the web server write to the entire /var/www directory and its contents, instead giving the above group permission only to the specific files where this is necessary. It is a good security principle to limit the web server's access to write to files to only those files that it is strictly necessary for - and it is a good idea to try and ensure those files are not executed directly (aren't .php or other executable scripts, for example).

  • My problem is that I don't know what are the files that are added or modified by the server. For example, I have sites with thousands of pages, and a script that generates the sitemap_index.xml and sitemap.xml files. Every 5000 URL is created a new file (eg. sitemap_15000.xml) to which later is rewritten to add all new URLs, and fails to write these files if it is not www-data, but I can not touch the files in sftp with the user user1 if is www-data. – alebal Feb 7 at 3:23
  • @alebal You can create a directory called sitemaps and make it writable by www-data and put your sitemaps in that directory. This way you won't have to worry about permissions being modified on that directory as users would very rarely (if ever) need to touch that directory since it is populated by apache only. – Dan Feb 20 at 8:35
  • I thought about it too, it's not a bad idea, but I have about 50 sites on this server each with its sitemaps, it would be a great job to change all the sitemap scripts, files, internal and external links, etc. Moreover the permissions on the sitemap files are modified and set by the php file that creates them, they should be able to do it themselves, no? – alebal Feb 20 at 22:17
1
+50

If you change the directory with a setgid bit, these problems should be history.

Try this

chmod 2775 /var/www

With the setgid bit set, all files in this directory belong to the group www-data (this should be the standard user and group of the folder, www-data:www-data) and not a user.

So as long as user1 is in the group www-data, the user should be able to modify, delete and open files.

Give it a try.

First enter the user to the appropriate group. Simplest way

sudo nano /etc/group

Find www-data and enter user1 after the ":" at the end

LOGOUT/LOGIN again

Now create the folder e.g.

sudo mkdir /var/www2

and then put the setgid bit on it

sudo chmod 2775 /var/www2 && sudo chown www-data:www-data /var/www2

now enter the folder, create another folder or file. It should work and look something like this (please make sure you see the "s" when using ls)

See here e.g.

simmel@tron:/var/www2
$ ls -la
total 0
drwxrwsr-x 1 www-data www-data   8 Feb 21 10:28 .
drwxr-xr-x 1 root     root     126 Feb 21 10:26 ..
drwxrwsr-x 1 simmel   www-data   0 Feb 21 10:28 blah

As you can see for the group part there is a RWS shown instead of RWX shown.

  • When I try to create a directory it says: permission denied. but I'm not sure about the group of user1... when I created it I also gave: usermod -aG sudo user1 Is User1 in the www-data group? How can I understand it and in case assign it? – alebal Feb 20 at 22:10
  • I added the info for you – s1mmel Feb 21 at 9:36
  • I tried, but something doesn't seem to work yet. I added user1 in the file etc/group, also made a reboot of the server. I have set the permissions on /var/www, because I have there all my sites, I can not change folder. But it still does not work, if I connect in sftp with FileZilla and user1, I do not have permission to create files and folders. In the end I still can not disable the root user, because I need to manage the files of my sites. – alebal Feb 21 at 19:54
  • well there might be another way, it is ugly but should def. work. edit /etc/passwd and give the user www-data a /bin/bash and also a password and login as www-data, this way you have no problems at all. but you might think a moment about security. maybe a sftp server could help here, vsftp is more or less easy to setup with virtual users (which then can point towrds user www-data). – s1mmel Feb 22 at 9:30
  • Umh... I do it to increase security, I don't want to risk decreasing it even more. I think rather calmly and with time to change the structure of files in my Sites, creating folders for sitemap files and images to be assigned to the user www-data, everything else to user1, but it will take some time unfortunately... – alebal Feb 22 at 21:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.