I have a company intranet that I have recently migrated from Novell to Linux. I am trying to set up user permissions and I am losing my mind.

There are a couple dozen departments, each with a dedicated directory in the web root. There are also shared directories for css, templates, images, etc.

I want all users to have read-only access to the entire site and read-write access only to their department's directory.

What I have already tried:

  • Set up a user group for each directory and assigned users to the groups as needed. Running into permissions and ownership inheritance issues.

  • Created a test user and then created an htdocs folder in test user's home directory. Then created a link, renamed it to the dept. name, and dropped the link into the main htdocs directory. Read access is perfect but I cannot list the contents of that directory when using Dreamweaver or an FTP client from the htdocs root.

I feel that there is some simple-but-crucial piece of info I am missing. Selectively setting up read-write access to htdocs subdirectories cannot possibly be this difficult.

Any advice for a non-experienced user, used to Novell and IIS?


Let's say you have Sue & Sam in Sales and Harry and Hermione in HR.

  • Create users sue, sam, harry, hermione
  • Create groups hr and sales.
  • Add sue & sam to group sales.
  • Add harry and hermione to group hr.
  • create folders hr and sales in /var/www/htdocs
  • change group of folder hr to group hr
  • ditto sales
  • set the group bit so files created in sales & hr inherit group
  • set permissions so group can write, others can only read
  • for convenience, create a softlink to hr from hermione and harry's home directories
  • ditto sales folk.
  • edit Apache config as needed (e.g. name based virtual server for sales.example.com)

Useful commands (see man pages)

  • mkdir
  • chown
  • chgrp
  • groupadd
  • useradd
  • groupmod
  • ln

† or wherever Apache's docroot is


File permissions in Linux hearken back to the old Unix roots that Linux grew out of. Perhaps a guide such as this one at TuxFiles.org or this material from TLDP can help you understand the basic permissions structure.

The tools you most probably need to familiarize yourself with are chown and chmod. Or GUI alternates, if you have a GUI installed on your server.


Your needs may be better served by ACLs rather than the classic UNIX permissions model.

Make one group for read-only access everywhere, then make one group for each department. Then use setfacl ("set file ACL") to give the read-only group read access to all the folders, and give each groups write access to its department folder.

Unfortunately, you'll need to look up the syntax for setfacl. I'm not very familiar with it. To get you started, here is my cronjob that gives the apache user on my server complete access to the public_html directory in each user's home:

setfacl -Rm "u:${WWW_USER}:rwX,d:u:${WWW_USER}:rwX" "$HOME_DIR/*/$WWW_DIRNAME"

I put this in a cron job so that any files that I put in my public_html directory will shortly be made accessible to apache.


Keeping with the groups idea, create all the directories you need for all your groups.

Make everything under the web root owned by www-data or apache or what ever user your web server runs under so it will have access. This will make everything owned by the web server and be apart of the web server's group:

EX: chown -R www-data:www-data /var/www

Then change the the group for each of those group folders:

EX: chown -R www-data:group1 /var/www/group1

Once all the folders have the right groups you can add group read/write access to them:

EX: chmod -R g+rw /var/www/*

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.