Tuesday, March 15, 2016

linux - What's the best way of handling permissions for Apache 2's user www-data in /var/www?



Has anyone got a nice solution for handling files in /var/www? We're running Name Based Virtual Hosts and the Apache 2 user is www-data.



We've got two regular users & root. So when messing with files in /var/www, rather than having to...



chown -R www-data:www-data



...all the time, what's a good way of handling this?



Supplementary question: How hardcore do you then go on permissions?



This one has always been a problem in collaborative development environments.


Answer



Attempting to expand on @Zoredache's answer, as I give this a go myself:





  • Create a new group (www-pub) and add the users to that group



    groupadd www-pub



    usermod -a -G www-pub usera ## must use -a to append to existing groups



    usermod -a -G www-pub userb



    groups usera ## display groups for user


  • Change the ownership of everything under /var/www to root:www-pub




    chown -R root:www-pub /var/www ## -R for recursive


  • Change the permissions of all the folders to 2775



    chmod 2775 /var/www ## 2=set group id, 7=rwx for owner (root), 7=rwx for group (www-pub), 5=rx for world (including apache www-data user)



    Set group ID (SETGID) bit (2) causes the group (www-pub) to be copied to all new files/folders created in that folder. Other options are SETUID (4) to copy the user id, and STICKY (1) which I think lets only the owner delete files.



    There's a -R recursive option, but that won't discriminate between files and folders, so you have to use find, like so:




    find /var/www -type d -exec chmod 2775 {} +


  • Change all the files to 0664



    find /var/www -type f -exec chmod 0664 {} +


  • Change the umask for your users to 0002



    The umask controls the default file creation permissions, 0002 means files will have 664 and directories 775. Setting this (by editing the umask line at the bottom of /etc/profile in my case) means files created by one user will be writable by other users in the www-group without needing to chmod them.




Test all this by creating a file and directory and verifying the owner, group and permissions with ls -l.




Note: You'll need to logout/in for changes to your groups to take effect!


No comments:

Post a Comment

linux - How to SSH to ec2 instance in VPC private subnet via NAT server

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. S...