Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On my laptop for testing, I simply chown each subdir of /var/www to my myuser:www-data. But, now that I am setting up a public facing server, I'm wondering if this is the proper way to do so? If not, what is the best way to allow a non-root account to write to /var/www.

share|improve this question
up vote 0 down vote accepted

In general, I would chown the directories to myuser:root, and set the mode to 0755 (for directories; 0644 for files).

I wouldn't have them with www-data as the group because your web server runs under that user/group. If someone compromises your web server, you don't want them to be able to write files anywhere. You do want to make sure the files are readable by www-data, but you can do that by setting the permission for "other" to allow it.

Another option is to leave /var/www totally owned by root, and always use sudo to copy files into it. This can help by making you think about exactly what you're doing before you change the web site, but isn't really suitable for scripted updates.

share|improve this answer

I would keep the default ownership and permissions and use Posix ACLs to give write permission to the users who need it.

The man page acl(5) gives a good overview and the man pages getfacl(1) and setfacl(1) will tell you how actually read and write ALCs.

share|improve this answer
The introduction of ACLs into an environment is something you should think through very carefully. Tools need to be specifically aware of their existance to deal with them properly: backup/archival tools and network filesystems, in particular, tend to be sore points. – esm Mar 3 '10 at 21:32

Generally speaking, I do something similar to what you do. If it's a single user that needs access, I chown /var/www/htdocs to that user and be done with it. If Multiple users need access remotely, I would suggest using a wiki, or wordpress, or some other CMS that will manage access permissions for you. The best way to do this really does vary depending on what your use case is. If you could be more clear about what you are doing with it and what you need. You'll get a better answer on how to properly configure it.

share|improve this answer
My own user needs write access to it, so I can edit files. Wordpress needs access for it's auto-update functionality. – Macha Mar 7 '10 at 13:35

You should probably be setting up the site as a virtualhost, and then you can use /srv/sites/ as the or whatever as the docroot. then, make a yourdomain group, or just call it 'webadmin' or something, and add your users to that group.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .