I have several Apache virtualhosts in the standard location:
These directories are owned by the user
www-data and the group
www-data, with permissions set to 770 (
I SFTP into these directories as
travis, who is a member of the
Here is my challenge: I would like to create a second SFTP user, named
chris, who only has permission to access one of these directories (example3.com).
So I tried this:
- created a new group named
- gave the new group ownership of the webroot:
sudo chgrp -R example3-www-data /var/www/example3.com/htdocs
- added the user
example3-www-dataas a secondary group (so Apache would have permission to read from the example3.com webroot)
- created a new user named
example3-www-dataas his primary group
chris' primary group has ownership of the
htdocs directory, so he should be able to access it. And the
www-data user also belongs to that group - so Apache should also be able to access the directory. Everything should work, right?
Nope! When I log in as
chris (whether via SFTP or via the shell), I'm told that I don't have permission to access
Why is that? Is it because
chris doesn't have access to the parent directories (e.g.,
/var/www/vhosts)? (I don't want to give him access to parent directories, if I can avoid it - remember, the whole point is to restrict his access to this one specific directory. I'd also prefer not to make this folder his home directory, because there will eventually be multiple such users who need the same access.)
Basically: how can I arrange my users / groups / file permissions such that:
- the user
traviscan upload files to all three webroots, and
- the user
chriscan only upload files to
- Apache can read/write/execute files uploaded by either user, without the need to manually adjust file permissions after uploading?
Sorry for the n00b question; I don't really understand how Linux file permissions are meant to be applied in situations like this. (Any general principles/tips/links in that area would be greatly appreciated.)
I doubt it matters, but I'm running Ubuntu 14.04 LTS.