Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I'm posing this question because I still haven't found a uniform method that I'm particularly fond of. Ideally, this combination of directory structure and permissions should suit any web server (don't assume Apache). I should also mention that I'm concerned only with *nix servers.

I'm primary looking for:

  • Best combination of uid/gid/other (names and octets)
  • Relatively secure (doesn't have to be uber paranoid)
  • Easy to use / maintain (CMS's are able to self-update, no permission issues)

Just for reference, the current stack I'm working on is Ubuntu 11.04 + Nginx + php-fpm + Wordpress, although the ideal solution should work for any website

share|improve this question

migrated from superuser.com May 12 '11 at 4:11

This question came from our site for computer enthusiasts and power users.

    
Please provide more details: will you host more websites on a server? How are you uploading files? –  Lekensteyn May 12 '11 at 6:56
    
Yes, I'd like to have the potential to host more than one website on the server. Assume that I have root access on some dedi/VPS and files are uploaded via SSH/SFTP. –  Dan Simmons May 12 '11 at 7:28

1 Answer 1

up vote 4 down vote accepted

Permissions can be granted on owner, group and others.

First, decide what permissions are necessary and which users are involved:

  • Nginx running as www-data (group www-data): read-only
  • php-fpm running as www-data (group www-data): read and write
    (if you'd like to allow operations like chmod, you should run php-fpm as the SFTP user. Beware: if someone can execute command on your server from PHP, he/she will be able to modify your files too, like .bashrc!)
  • sftp / SSH: full permissions
  • Other users: no read and write permissions

Only the owner of a file / directory can change permissions and it's preferred to give the SSH user this ownership. Why? Because it's idiot that you cannot modify your own files in the webroot and doing everything as root is a bad idea.

Regular users cannot do change the group of a file / directory, only root can do that. A special SETGID bit makes every file and directory in a directory inherit the group. With the right permissions set, both php-fpm and the SSH user can modify files.

  • Owner: your SSH user
  • Group: www-data
  • Permissions for files: rw-rw---- (0660)
  • Permissions for directories: rwxrwx--- (2770) The execute bit (2) is needed to descend into a directory. Execute info coreutils 'file permissions' to get more information about this bit
  • umask 007 so that the owner and group can write to files / directories and other users do not get permissions.

Assuming that your webroot is located at /var/www/website1, change the owner/group and permissions by running:

sudo chown -R your_ssh_user_here:www-data /var/www/website1
sudo find /var/www/website1 -type f -exec chmod 660 {} \;
sudo find /var/www/website1 -type d -exec chmod 2770 {} \;

Add yourself to the www-data group:

sudo usermod -a -G www-data your_ssh_user_here

You need to re-login to become a member of the group.

Additional configuration is needed to ensure that websites cannot access other files if php-fpm is running as the same user.

share|improve this answer
    
Thanks so much! I appreciate the completeness of your answer! It hit all of the major points I was looking for. –  Dan Simmons May 12 '11 at 16:56
    
Two questions for clarification: 1) What's the purpose of joining www-data with your ssh_user? 2) After reading about the setgid bit, what's the purpose of toggling it for directories/subdirs? Put another way, in what situations will this behavior differ from normal? –  Dan Simmons May 12 '11 at 18:41
    
@Dan Simmons: CMS'es (and PHP scripts) write to the directories as www-data, the files will be owned by www-data with group www-data (since the process runs under that group). Your SSH user will create files/directories owned by your_ssh_user_here. Without the setgid bit, these files will have the group your_ssh_user_here. With no read permissions for the other, PHP and nginx won't be able to access the files/directories. The setgid bit is inherited by the directories beneath (but can be removed). –  Lekensteyn May 12 '11 at 18:56
    
Thanks so much for the pointers. I'm just curious, is there any security risk in giving www-data 'rwx'? Also, what processes access files/directories as 'other'? –  Dan Simmons May 16 '11 at 3:18
    
Giving www-data rwx on directories allows www-data to read, write and descend into directories. If www-data is the owner, it'll be able to change the file permissions as well. If www-data does not need write access, you'd better revoke it to r-x (principle of least privilege). Processes run under an user which are a member of one ore more groups. If a file is not owned by the user of that process or if the process user is not a member of the group of the file, it'll get the permissions of "Other" (a.k.a. "world"). –  Lekensteyn May 16 '11 at 8:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.