2

I have several Apache virtualhosts in the standard location:

  • /var/www/vhosts/example1.com/htdocs
  • /var/www/vhosts/example2.com/htdocs
  • /var/www/vhosts/example3.com/htdocs

These directories are owned by the user www-data and the group www-data, with permissions set to 770 (drwxrwx---).

I SFTP into these directories as travis, who is a member of the www-data group.

Here is my challenge: I would like to create a second SFTP user, named chris, who only has permission to access one of these directories (example3.com).

So I tried this:

  • created a new group named example3-www-data
  • gave the new group ownership of the webroot: sudo chgrp -R example3-www-data /var/www/example3.com/htdocs
  • added the user www-data to example3-www-data as a secondary group (so Apache would have permission to read from the example3.com webroot)
  • created a new user named chris, with example3-www-data as his primary group

So: chris' primary group has ownership of the htdocs directory, so he should be able to access it. And the www-data user also belongs to that group - so Apache should also be able to access the directory. Everything should work, right?

Nope! When I log in as chris (whether via SFTP or via the shell), I'm told that I don't have permission to access /var/www/vhosts/example3.com/htdocs.

Why is that? Is it because chris doesn't have access to the parent directories (e.g., /var/www/vhosts)? (I don't want to give him access to parent directories, if I can avoid it - remember, the whole point is to restrict his access to this one specific directory. I'd also prefer not to make this folder his home directory, because there will eventually be multiple such users who need the same access.)

Basically: how can I arrange my users / groups / file permissions such that:

  • the user travis can upload files to all three webroots, and
  • the user chris can only upload files to /var/www/vhosts/example3.com/htdocs, and
  • Apache can read/write/execute files uploaded by either user, without the need to manually adjust file permissions after uploading?

Sorry for the n00b question; I don't really understand how Linux file permissions are meant to be applied in situations like this. (Any general principles/tips/links in that area would be greatly appreciated.)

I doubt it matters, but I'm running Ubuntu 14.04 LTS.

  • The point of running the web server as the www-data user and group is that this is an unprivileged user - the www-user user doesn't have write permission anywhere - this is a good security measure. For this reason you shouldn't add users to this group, it's meant for daemons only. Don't set file permissions to give this user or group write access to any files (in rare cases a web app might need it for some files). Everything you want to do can be done by creating your own groups and adding users to those, not by re-using the www-data group which is not supposed to be used like this. – thomasrutter Jul 14 '15 at 15:17
  • Thanks. Could you give me an example of what groups I would need to create, and how I would modify the permissions of the various webroot directories (if at all)? – greenie2600 Jul 14 '15 at 15:21
  • I found the tutorial linked below, which explains how to grant users (e.g., my chris user) access to their own site directories. However, it doesn't explain how to grant another user (e.g., my travis user) access to all of the site directories. virtualvcp.com/linux-technical-guides/… – greenie2600 Jul 14 '15 at 16:49
  • Need to create a new group, add those users who should be able to edit all dirs, and add group write permissions to those files. But to make sure new files they create are still editable by the group you need to do a fair bit. Have a read of unix.stackexchange.com/questions/12842/… - you can use umask on those user's profiles - or the alternative is ACLs. To me ACLs are probably more complexity than you want. Sorry this is not a proper answer, and just a comment with some pointers. – thomasrutter Jul 15 '15 at 0:27

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.