I'm running Ubuntu 16.

I have a public facing site, set up at /var/www/html/

There's some CMS software running, installed at /var/www/html/cms

The config files can be stored outside of web root for added security, so I have moved them to /var/www/config/

However, the CMS requires /var/www/config/ to have 777 permissions as it needs to write to it. (well, I think this is partly due to my user config ubuntu vs www-data, but 777 is the only permission which works).

The virtualhost setup has the DocumentRoot as /var/www/html/

In apache2.conf, I have:

<Directory /var/www/>
        Options FollowSymLinks
        AllowOverride None
        Require all granted
        Header always append X-Frame-Options SAMEORIGIN

Now, my question... is this as secure as I think? I'm happy having the cms config files outside of DocumentRoot, BUT have had to give it 777 permissions and apache.conf does grant permissions to /var/www (even though there is not a virtualHost config pointing that low.

Should I be:

a) looking at fixing permissions/groups so the cms can run with 755 (or 775) permissions on the /var/www/config directory? b) amend the apache2.conf so it doesn't grant to /var/www/html (but rather just to /var/www/html)? c) happy and leave it as is?

Thanks in advance


By adding www-data to the ubuntu group:

usermod -a -G www-data ubuntu

I can then change the permissions of /var/www/config/ to 755 and the cms is happy with those permissions.

However I am not sure I want www-user to have the same permissions as the ubuntu user...

As a further note, the files and folders are all owned by ubuntu because this is the user (only user) who has SFTP access to deploy files. If I amended ownership to www-data, everytime something new is deployed, it'd revert back to ubuntu ownership.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.