What is the best way to allow a user to write to the /var/www directory?

Question

On my laptop for testing, I simply chown each subdir of /var/www to my myuser:www-data. But, now that I am setting up a public facing server, I'm wondering if this is the proper way to do so? If not, what is the best way to allow a non-root account to write to /var/www.

Answer 1

In general, I would chown the directories to myuser:root, and set the mode to 0755 (for directories; 0644 for files).

I wouldn't have them with www-data as the group because your web server runs under that user/group. If someone compromises your web server, you don't want them to be able to write files anywhere. You do want to make sure the files are readable by www-data, but you can do that by setting the permission for "other" to allow it.

Another option is to leave /var/www totally owned by root, and always use sudo to copy files into it. This can help by making you think about exactly what you're doing before you change the web site, but isn't really suitable for scripted updates.

Answer 2

I would keep the default ownership and permissions and use Posix ACLs to give write permission to the users who need it.

The man page acl(5) gives a good overview and the man pages getfacl(1) and setfacl(1) will tell you how actually read and write ALCs.

Answer 3

Generally speaking, I do something similar to what you do. If it's a single user that needs access, I chown /var/www/htdocs to that user and be done with it. If Multiple users need access remotely, I would suggest using a wiki, or wordpress, or some other CMS that will manage access permissions for you. The best way to do this really does vary depending on what your use case is. If you could be more clear about what you are doing with it and what you need. You'll get a better answer on how to properly configure it.

Answer 4

You should probably be setting up the site as a virtualhost, and then you can use /srv/sites/yourdomain.com/ as the or whatever as the docroot. then, make a yourdomain group, or just call it 'webadmin' or something, and add your users to that group.