I'm posing this question because I still haven't found a uniform method that I'm particularly fond of. Ideally, this combination of directory structure and permissions should suit any web server (don't assume Apache). I should also mention that I'm concerned only with *nix servers.

I'm primary looking for:

  • Best combination of uid/gid/other (names and octets)
  • Relatively secure (doesn't have to be uber paranoid)
  • Easy to use / maintain (CMS's are able to self-update, no permission issues)

Just for reference, the current stack I'm working on is Ubuntu 11.04 + Nginx + php-fpm + Wordpress, although the ideal solution should work for any website

  • Please provide more details: will you host more websites on a server? How are you uploading files?
    – Lekensteyn
    Commented May 12, 2011 at 6:56
  • Yes, I'd like to have the potential to host more than one website on the server. Assume that I have root access on some dedi/VPS and files are uploaded via SSH/SFTP. Commented May 12, 2011 at 7:28

1 Answer 1


Permissions can be granted on owner, group and others.

First, decide what permissions are necessary and which users are involved:

  • Nginx running as www-data (group www-data): read-only
  • php-fpm running as www-data (group www-data): read and write
    (if you'd like to allow operations like chmod, you should run php-fpm as the SFTP user. Beware: if someone can execute command on your server from PHP, he/she will be able to modify your files too, like .bashrc!)
  • sftp / SSH: full permissions
  • Other users: no read and write permissions

Only the owner of a file / directory can change permissions and it's preferred to give the SSH user this ownership. Why? Because it's idiot that you cannot modify your own files in the webroot and doing everything as root is a bad idea.

Regular users cannot do change the group of a file / directory, only root can do that. A special SETGID bit makes every file and directory in a directory inherit the group. With the right permissions set, both php-fpm and the SSH user can modify files.

  • Owner: your SSH user
  • Group: www-data
  • Permissions for files: rw-rw---- (0660)
  • Permissions for directories: rwxrwx--- (2770) The execute bit (2) is needed to descend into a directory. Execute info coreutils 'file permissions' to get more information about this bit
  • umask 007 so that the owner and group can write to files / directories and other users do not get permissions.

Assuming that your webroot is located at /var/www/website1, change the owner/group and permissions by running:

sudo chown -R your_ssh_user_here:www-data /var/www/website1
sudo find /var/www/website1 -type f -exec chmod 660 {} \;
sudo find /var/www/website1 -type d -exec chmod 2770 {} \;

Add yourself to the www-data group:

sudo usermod -a -G www-data your_ssh_user_here

You need to re-login to become a member of the group.

Additional configuration is needed to ensure that websites cannot access other files if php-fpm is running as the same user.

  • Thanks so much! I appreciate the completeness of your answer! It hit all of the major points I was looking for. Commented May 12, 2011 at 16:56
  • Two questions for clarification: 1) What's the purpose of joining www-data with your ssh_user? 2) After reading about the setgid bit, what's the purpose of toggling it for directories/subdirs? Put another way, in what situations will this behavior differ from normal? Commented May 12, 2011 at 18:41
  • @Dan Simmons: CMS'es (and PHP scripts) write to the directories as www-data, the files will be owned by www-data with group www-data (since the process runs under that group). Your SSH user will create files/directories owned by your_ssh_user_here. Without the setgid bit, these files will have the group your_ssh_user_here. With no read permissions for the other, PHP and nginx won't be able to access the files/directories. The setgid bit is inherited by the directories beneath (but can be removed).
    – Lekensteyn
    Commented May 12, 2011 at 18:56
  • Thanks so much for the pointers. I'm just curious, is there any security risk in giving www-data 'rwx'? Also, what processes access files/directories as 'other'? Commented May 16, 2011 at 3:18
  • Giving www-data rwx on directories allows www-data to read, write and descend into directories. If www-data is the owner, it'll be able to change the file permissions as well. If www-data does not need write access, you'd better revoke it to r-x (principle of least privilege). Processes run under an user which are a member of one ore more groups. If a file is not owned by the user of that process or if the process user is not a member of the group of the file, it'll get the permissions of "Other" (a.k.a. "world").
    – Lekensteyn
    Commented May 16, 2011 at 8:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.