I'm a web developer. I'm allowing SSH access to my machine for a couple of people.

I want to make sure that they can't access my files in /var/www/.

So is it possible to make these files readable only to the web server and give read/write access to the root user?


3 Answers 3


I assume the Apache user is called www-data. If you want the files in /var/www/ to become readable only by this user, you need to give it ownership:

sudo chown -R www-data /var/www/

Now you want www-data to be the only user that can actually read/write those:

sudo chmod -R 700 /var/www/

Note that root always has read/write access to any file, regardless of the permissions. Whether this setup is a good idea or not – well, I'd rather chroot these SSH users to their home folders. See Can I create an SSH user which can access only certain directory?


Depending on your web server's user (usually www-data):

chown www-data /var/www
chmod -R 700 /var/www

This will set the www-data user the owner of your /var/www directory and will allow accessing the directory only to the owner.


You may want to make root or another user the owner of your web content. This will prevent the web server from overwriting content if someone gains access via a script or other entry point. Replace root in these commands with whatever user you want to own the content.

chown -R root:www-data /var/www
chmod 2750 /var/www

To allow the user (other than root) to maintain the content you will need to add the user to the www-data group.

adduser user www-data

Some web applications may have some directories where they write dynamic content. To allow access either change the owner to www-data or allow group write.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.