3

I've got apache2 running on Ubuntu Server 12.04 LTS on an old laptop. It's on my local network to act as a webserver to help me learn PHP (and linux).

The default owner for the /var/www folder (where the webpages for apache are stored) is www-data. With the owner set to www-data I can't copy files/folders to that folder over ftp. If I change the owner of the /var/www folder to james (my ftp user) then I can move files over ftp but apache doesn't have access to display any pages or sub folders.

What should the correct owner be to allow access for ftp user james and apache?

6
  • Is James in the www-data group?
    – Dan
    Aug 16, 2013 at 18:08
  • no i don't believe so. is www-data a group not a user? sorry bit of a linux noob
    – Erresen
    Aug 16, 2013 at 18:09
  • james is now in the www-data group. i still can't write to that folder over ftp as james
    – Erresen
    Aug 16, 2013 at 18:20
  • The default owner is not www-data, it's root. Oct 2, 2014 at 6:18
  • Don't put normal users in the www-data group. www-data is intended to be an unprivileged user and group with no write access, used exclusively by the web server itself only. You should create your own groups instead and use those if you wish to add people to a group and control write access by group. Oct 2, 2014 at 6:32

2 Answers 2

1

I'd recommend setting it to be owned by james:james.

Alternatively, you could leave it as root:root and requite sudo for anybody deploying files in there, but if you are directly working in the /var/www directory (rather than working somewhere else and pushing the files there) that may not be convenient, and it won't work with FTP either.

You can set the owner of /var/www to whatever you like, as long as the www-data user has read access. You can achieve this by setting permissions to allow world read access (as is default).

By default, it is owned by root:root (not www-data as you state in the question).

  • For security, it is not a good idea to set it to be owned by www-data. www-data is intended to be an unprivileged account which cannot write to any files, and can only read them.

    Yes, occasionally you may need to give www-data the permission to write to a given file, but for security this should be strictly limited to those particular files, and precautions should be taken such as making sure no such files are executable as scripts by the web server (ie they are not in a location where they may be interpreted as PHP or CGI files), etc.

  • For security, it is an even worse idea to set the file permissions to world-writable (eg, 777). Unprivileged users such as www-data should not be able to write to files in this directory. The only people who need write access will be the people who are actually writing files in there.

  • The /var/www directory is intended to be yours to do with what you like. It makes sense to set ownership to whichever account will be editing the files. You can create a group for this purpose if you have multiple people, but in this case it's just you.

    Note: if creating a group, create a new group. Do not re-use the www-data group as that is intended to be an unprivileged group without write access to any files (as I explain above).


Too often I see people recommending adopting very bad security practices such as setting /var/www to be owned by www-data, or adding people to the www-data group in order to give that group editing privileges, or setting /var/www to be world-writable (eg 777). By doing any of this you are potentially opening yourself up to significant security problems.

6
  • It sounds like you're saying it's harmful for human user accounts to be members of the www-data group, as though that alone would increase the power of a separate unprivileged user (such as the www-data user) in the www-data group. That is not the case. Group membership is a way users gain abilities, but a user's abilities do not rub off on a group of which it is a member, nor on other members of the same group. I hope you mean that the practice of making the www-data group confer write access (and adding users to it for that purpose) is harmful--which is true. Maybe edit to clarify? Oct 6, 2014 at 23:41
  • There is no reason to add human user accounts to the www-data group unless you are then going to give the www-data group some privileges it wouldn't normally have, and it's this giving of privileges to the www-data group that is harmful to security. If you only add users to the www-data group but change no file permissions or ownerships anywhere, it'll do nothing. Adding users to the www-data group is always an indication that somebody is probably doing something bad for security, because there is no legitimate reason to do it. Oct 7, 2014 at 0:15
  • "always an indication that somebody is probably doing something bad for security" Agreed. In contrast, having the www-data user own /var/www, or chmoding it 777, are actually, directly bad for security. You might consider making this distinction clearer--and also distinguishing between the user and the group whose names are www-data. (Btw, I can imagine normal users legitimately in www-data: it's not hard to think of a just slightly odd scenario where /var/www shouldn't be world-readable but some users should have readonly access. But that's not the issue that concerns me.) Oct 7, 2014 at 0:39
  • I've made a subtle edit. Oct 7, 2014 at 2:38
  • +1 Old post but highly educating answer and exchange. Something bugs me though. In my case /var/www is controlled by root:www-data with drwxr-sr-xprivileges. So I "sudo-write" everything as the need arises. A year ago I added myself to the www-data group as a hack precisely in anticipation of what @EliahKagan suggests on world-read access... But how do you arrange for a select group of users controlling the contents of /var/www with rwx privileges ? I am willing to appoint myself the owner of /var/www instead of root, but it does not solve my pbm. Will you complete yr answer on that ?
    – Cbhihe
    Sep 14, 2015 at 8:11
0

The ideal permission is to make yourself the owner and the www-data the group, set youself as the owner of files by sudo chown -R yourname:www-data /var/www/public_html/ and sudo chmod -R g+w /var/www/public_html/ make sure you change the directory and username appropriately. You will be able to write files and apache processes wont be hindered. I am suggesting this as the OP is running a local instance of APACHE for practice purpose and will be using lots of scripts or opensource scripts like wordpress, etc, that will require write access. Here security is not a prime concern as the local server will not be using a public ip and ease of installing, copying and running scripts is of prime importance. The OP can focus on learning PHP rather than administering the server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .