2

I want to be able to only allow a user read/write permissions to a certain folder, and not any of the parent folders

so for instance

mywebsite

Can only access /var/www/html/mywebsite

And not /var/www/html/otherwebsite

I have tried:

chown -R www-data /var/www/html
chown -R mywebsite:www-data /var/www/html/mywebsite
chmod -R 770 /var/www/html

The problem I am getting is that when logged in to mywesbite I don't have read write permissions to the mywebsite folder, or any other folder for that matter

What am I doing wrong?

5

To give user mywebsite read/write permission inside /var/www/html/mywebsite:

chown -R mywebsite /var/www/html/mywebsite 

That should be sufficient. You should not have to alter group owner or permissions because the user owner should be given read/write permissions already.

If you wanted to grant a group read/write permission inside that folder, say, group my-group, you'd need:

chgrp -R my-group /var/www/html/mywebsite 
chmod -R g+w /var/www/html/mywebsite

Important notes

  1. Don't set the ownership (either user or group) of files within /var/www to the www-data user. The point of having the web server run as the www-data user is that this is an unprivileged account, unable to modify any files. If you set some files to be owned by this user, you are negating that security measure. If you need your web server to be able to modify certain files, only set ownership for those particular files and be very careful not to allow direct execution (eg via PHP) of them. In general, never set it so that www-data can modify files.

  2. When doing a recursive chmod, it is often better to use letters than numbers, eg chmod -R g+w something rather than chmod -R 770 something. This is because the former is able to modify only the permission you want, and leave the others. By default, directories and files will have different "execute" permissions - files will have it off (eg 644) and directories on (eg 755) because this permissions has a different meaning for directories. If you do chmod -R 770 something then regular files will have execute permissions turned on. In general it's a good idea to only modify what you need.

    Another thing to note is that 770 would remove the world-readable permission, which will prevent the web server (which runs as an unprivileged user) being able to read it. In this case it's also preventing the user mywebsite being able to see the /var/www/html/mywebsite directory at all, because you've set the parent directory /var/www/html to 770.

|improve this answer|||||
  • Consider some things like WordPress do need some write privileges in those folders. Primary ownership shouldn't have www-data but group permissions may need write for installs and such. – Thomas Ward May 11 '15 at 0:07
  • Yes which is why I said "If you need your web server to be able to modify certain files, only set ownership for those particular files and be very careful not to allow direct execution (eg via PHP) of them." In general, never set it so that www-data can modify files. – thomasrutter May 11 '15 at 0:08
  • Thomas what do you make of the Apache instructions: wiki.apache.org/httpd/FileSystemPermissions Do these make sense and are they secure enough for an internet facing website? – Craig Aug 22 '15 at 23:16
  • Yes, from what I can see those recommendations are good. Their example names the unprivileged user "apache" where Ubuntu instead uses "www-data". Their example does not give write permission to this "apache" user, which is the important part - note that it's added to the web-content group but this group does not have write access (the page acknowledges this is a limitation). Their bottom example, specifically the chmod 640 even hides files away from other processes, (no world-read-bit) which allows for storing secret data in your source eg PHP files. – thomasrutter Aug 23 '15 at 0:56
  • Thanks, it looks like I finally have a good solution to be able to easily modify the www files whilst keeping them secure from the rest of the world. – Craig Aug 23 '15 at 7:10
1

What I did on Ubuntu 16.04 (for my future reference too):

sudo groupadd web-content                 # creates a new group 'web-content'
sudo usermod -a -G web-content myuser     # adds 'myuser' to the group
sudo usermod -a -G web-content www-data   # adds 'www-data' to the group
sudo chown -R myuser:web-content /var/www/html          # changes owner to 'myuser' and 'web-content' group
sudo find /var/www/html -type f -exec chmod 640 {} \;   # applies rw for myuser and r permissions to all files
sudo find /var/www/html -type d -exec chmod 750 {} \;   # applies rwx for myuser and rx permissions to all directories
sudo systemctl restart apache2.service    # restarts the apache web service

Please let me know if this is not secure or sensible.

(Note. I just wanted to add this as an additional comment to my previous comment, but it lost the formatting of the code lines when I did that)

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.