Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a Linux box being shared by various developers. They want to deploy their war files in apache tomcat which in shared location (/opt/tomcat).

Since they don't have sudo access, I have to change the folder permission for tomcat directory.

directory structure under /opt/tomcat is -

bin/

conf/

lib/

logs/

temp/

webapps/

work/

What are the best practices in above situation - Most suitable access permission to user ? For time being, I have changed permission to 777 to webapps and logs.

Thanks

share|improve this question

1 Answer 1

You need to follow the principle of least privilege. The server (probably www-data, but you'll need to check) needs to be able to read most of the files (let's say all) and write in the logs only. The web developers are allowed to write where they need. Set the sticky bit on the directories so that only the owner of a file can delete it.

In practice you need to create a group (for instance webdev) and add all developers and the server to it (usermod -aG webdev <user> or usermod -A webdev <user> depending on your Linux flavor). chown all the files and directory to the webserver user, chmod all directories to 500 and all files to 400 (except in bin where the executables need to be 500 as well).

Grant write permissions on /opt/tomcat to the group (that would be 570) and set the sticky bit so that they can remove only the files they own (chmod 1570). Grant the server write permission to the logs, and read permissions to the developers (0740 for the folder, 0640 for the files, the sticky bit is probably not necessary, and never grant it to a file, only the folders, as it has a different meaning (execute with the permissions of the owner when the file is executable)).

Then you'll need to grant write permissions (1570) to webdev on some of the directories. You'll need some trial and error here, and it could be application dependent. Those folders must be 1570, while some others can be 0500).

The developers will need to grant read access on their files to the group so the server can read them (that's 640), and also execute on the directories (that's 750).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.