up vote 0 down vote favorite
share [g+] share [fb]

what should be the permissions of the folder var/www in my Ubuntu ?

I need it to be safe and at the same time I need ftp users to be able to edit it.

I was wondering if I should create a group with all permissions and add ftp users to this group in unix.

what's the standard way to do it ?

link|improve this question
100% accept rate
Depends on what you mean by safe and at the same time ftp users need to be able to edit it. – Chris Sep 21 '10 at 18:01
Generally I like to create a group like www-data which has rights to the www directory. – Randolph West Sep 21 '10 at 18:03
feedback

2 Answers

up vote 0 down vote accepted

As you said, the best way for ftp users to be able to access is to give all files/folders within /var/www/ the "ftp group" you create. Make sure all users ftping are in this group.

sudo usermod -a -G "ftp group" <user>  // the -a is important here so you append the group

Also, for default permissions of files have a look at this: default folder permissions on linux

If you like this answer, vote it up. Its good for the community.

link|improve this answer
feedback
up vote 0 down vote

Not sure there is a "standard" but one possible way to approach it is :

/var/www permissions set to 775 with owner of yourself:htmlgrp

The htmlgrp would be composed of those users who need to edit files in /var/www

If you're worried about "being safe" then I suggest you use scp (ssh encrypted copy program) instead of ftp. This is the choice most hosting companies prefer you take.

Edited: to change perms from 770 to 775

link|improve this answer
1  
Hmm, 770 perms creates a possible security situation. The same people can read and write the content, so it means a broken in webserver can write content. You want the webserver using it's own user/group that can't write anything on disk anywhere, other than temp files. This probably necessitates 775, or ACLs. – Rich Homolka Sep 21 '10 at 20:10
@Rich: I'm not following you. The people in charge of the content have to be able to write it. I didn't say anything about what id the webserver is running as because that varies depending on what server you use and the OP didn't specify. Assuming the server is already hacked is probably not a good way to think about security (from the average users standpoint at least). Besides, to nitpick, 775 is more permissive, not less. – hotei Sep 22 '10 at 0:28
@Rich: You're right about the 775, I just looked at my own webserver and I see 775. Apache2 runs as www-data and that's what needs the 5. I'm going to modify the answer to reflect this. – hotei Sep 22 '10 at 0:48
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.