Im having issues as to which user should own my www directory - ftp or apache? When set to the ftp user, the user can add, remoe and easily modify files but php file system actions generate permission denied errors (ofcourse because they require the user to be apache). If however, the www directory is chown to apache, the ftpuser wont be able to perform some actions like file modification and deletion. Any one ever encountered similar issue? What's the fix? Thanks
3 Answers
This is what groups are for.
You can add the ftp
user to the apache
group, and vice-versa. Or, even better, you could add them to a third group that you create specifically for this purpose.
e.g.
# groupadd mygroup # useradd -G mygroup ftp # useradd -G mygroup apache # chown -R :mygroup /var/www # chmod -R g+rw /var/www
Those commands do the following:
- Creates new group 'mygroup'
- Adds ftp user to mygroup
- Adds apache user to mygroup
- Recursively grants group ownership to contents of /var/www/ to mygroup
- Recursively grants group read & write perms to contents of /var/www/
You just need to make sure that files added in the future belong to the 'mygroup' group and have the appropriate permissions for both apache and ftp to read/write them.
![](../../users/profiles/14428.webp)
- 2,800
- 2
- 23
- 33
-
3Combining "`find /var/www -type d -print0 | xargs -0 chmod g+s /var/www`" with a umask of 002 will ensure that new files and directories in /var/www inherit the appropriate group and permissions for the group to have r/w access. Many Linux distributions now default to a umask of 002 (the same ones that default to creating a new group for every new user) – freiheit Sep 25 '10 at 03:15
-
This answer works perfectly! But I am having one issue where the user can still view all the other directories outside of `var/www` is there a method to restrict this? – maxisme Feb 05 '15 at 13:10
-
4Lines 2 and 3 won't work if the users already exist (on CentOS 7). In this case use `usermod` e.g. `usermod -G mygroup ftp` – nick Nov 20 '15 at 15:15
-
Simple, self-explanatory, understandable! Perfect! Thanks, @hobodave! – GTodorov Jun 26 '16 at 00:33
Most of your content should be owned by a user other than apache. Assuming your use FTP to update your content, you can set all the files to be owned by ftp:apache. I would suggest using SCP for SFTP instead of ftp. Files should have permissions 644 or 640 and directories permissions 755 or 750.
For files and directories the application needs to write to add group write access.
![](../../users/profiles/36241.webp)
- 27,354
- 3
- 35
- 69
I had a similar problem with a php page a built that would copy a folder on the server with a different name. I fixed it by turning off php safe mode.
![](../../users/profiles/99903.webp)
- 1
-
2PHP safe mode is there for a reason. Turning it off isn't a good idea at all. – user9517 Nov 04 '11 at 08:40