1

On a dedicated server hosting one website, running Linux with no control panel, I'm trying to grant permission for multiple users to edit the public HTML folder (/var/www/html/).

I want to make sure I do this the best way, I imagine if I set the permissions loosely via CHMOD, it will allow anyone who can reach the folder via FTP to change it. Is the solution to set up a wheel group, add the intended users to the wheel group, and then set the permissions to the wheel group?

Right now, only one user can edit the public HTML.

2

1 Answer 1

6

Your solution is pretty close to what I'd recommend, but why do you specifically reference the wheel group? On many distributions the group wheel has full access to the sudo command granting then full root access to the system.

Let's assume you make a new group called webadmins:

groupadd webadmins 

Then you want to set the proper permissions to allow your webadmins to make changes:

chown root:webadmins /var/www/html -R 

The -R will set the permissions on all existing files. One issue that's common is if joe creates a file in /var/www/html it will, by default, be owned by joe and grouped to joe's default group. We can remedy this by setting the SETGID bit on the parent directory so new files will be grouped to webadmins by default:

chmod g+s /var/www/html 

One last issue is that your webserver will need to access these files as well. I, personally, don't like to leave global read access on /var/www/html because of the likelihood that someone will drop a .php script in there, so I set the directory to 770:

chmod 770 /var/www/html 

And then I add the apache user (www-data on RedHat systems, typically) to the webadmins group:

usermod -aG webadmins www-data 

Hope that helps!

2
  • This isn't ideal because giving Apache write permissions on your website files is a security risk. I wrote a similar answer over here. serverfault.com/q/357108/23300 Commented Feb 6, 2012 at 2:42
  • I like your approach Nic. You're definitely correct that write permissions from Apache is a security risk. Commented Feb 6, 2012 at 22:08

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.