3

After a fresh installation of Ubuntu i am trying to figure out how to do the permissions for Apache2. I use my setup for Local development for CraftCMS websites. This means Apache needs to be able to serve the files, I need to be able to edit the files and the CraftCMS php commandline tool has to be able to run from the terminal. And this has to work for multiple virtual hosts.

I've set up a workflow but I am not certain if this is the right way to achieve everything I want.

SO I did the following;

After installing everything I ran the following commands to set up the permissions :

sudo adduser $USER www-data
sudo chown $USER:www-data -R /var/www
sudo chmod 0774 -R /var/www
sudo chmod g+s -R /var/www
  • The first commands adds myself to the group www-data (the apache2 group).
  • The 2nd line changes the owner and group of /var/www/ and subfolders to me as the owner and www-data as group.
  • The 3rd line adds permissions so owner and group can read write and execute. others can only read.
  • The fourth line assures any new files and folders within /var/www will have the same permissions.

As of now, everyhing works as planned. I can edit the files and apache can run the websites locally. One thing that doesn't work now is the command line tool ./craft as it doesn't have permissions to run there. To fix this I came up with the following solution:

alias craft="sudo -u www-data php ./craft"

With this alias I can run the ./craft command as www-data making it always run as the group has all permissions required to execute within the /var/www folder. (I am not sure if this is a good way to fix this.)

So that's it, everything 'works' but it feels like a 'hacky' way to get it to work.. I am not certain if this is the way it is supposed to be working. And I would love to hear improvements.

1

sudo chmod 0774 -R /var/www

You should make this 2 commands. 1 for files. 1 for directories. It is more secure to use 0 for others: generally you only want the user and the group to be able to do anything with files. The least permissive permissions would be set like this:

find . -type f -exec chmod 640 {} \
find . -type d -exec chmod 750 {} \

Not saying you have to do it like this! 644, 755 or your 774 is a little more permissive but works too. Lower than 640/750 is possible too: 600 and 700 is you so not need a group but that hardly ever is the case. I tend to use those 2 commands and if something does not work (ie. forbidden notice from webserver) I would "up" the permissions and try again. If I end up with a working website where I needed to "up" others I know there is a file that has bad owner or permissions.

alias craft="sudo -u www-data php ./craft"

That works but is that needed? You said you used 774 as permissions so your group should be able to execute it. Check from the user with

groups

you are indeed in group www-data.

  • Hey, somehow when I git pull into my /var/www/website/ folder the permissions won't be set as expected. I executed my commands as I have written them down in my question. When I git pull the permissions of a folder (a folder where apache needs to write) is rwx r-x r-x. So it doesn't get permissions 774 automatically? How do I achieve this? @Rinzwind – user6842332 Aug 4 at 9:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.