0

I'm a web developer. I'm allowing SSH access to my machine for a couple of people.

I want to make sure that they can't access my files in /var/www/.

So is it possible to make these files readable only to the web server and give read/write access to the root user?

0

3 Answers 3

4

I assume the Apache user is called www-data. If you want the files in /var/www/ to become readable only by this user, you need to give it ownership:

sudo chown -R www-data /var/www/

Now you want www-data to be the only user that can actually read/write those:

sudo chmod -R 700 /var/www/

Note that root always has read/write access to any file, regardless of the permissions. Whether this setup is a good idea or not – well, I'd rather chroot these SSH users to their home folders. See Can I create an SSH user which can access only certain directory?

0

Depending on your web server's user (usually www-data):

chown www-data /var/www
chmod -R 700 /var/www

This will set the www-data user the owner of your /var/www directory and will allow accessing the directory only to the owner.

0

You may want to make root or another user the owner of your web content. This will prevent the web server from overwriting content if someone gains access via a script or other entry point. Replace root in these commands with whatever user you want to own the content.

chown -R root:www-data /var/www
chmod 2750 /var/www

To allow the user (other than root) to maintain the content you will need to add the user to the www-data group.

adduser user www-data

Some web applications may have some directories where they write dynamic content. To allow access either change the owner to www-data or allow group write.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .