Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like advice about permissions on directories and files on a web/ftp server.

Here is my situation:

Debian Server with those user:group

  • userme:userme for SSH
  • www-data:www-data for apache/php
  • ftpuser:ftpgroup for pure-ftpd

File system :



  • Files and dirirectories in siteX.tld will be uploaded by ftpuser.
  • There is a "upload" subdir in siteX.tld where www-data will be able to create directories and write files.
  • Ftpuser should be able to delete those files created by www-data.
  • AppX directories are created by userme in ssh
  • they should be read by www-data (with a special directory where apache should be able to create/delete files)
  • And be accessible by ftpuser in read-only mode (for remote updates purposes)

What I thought to do (but I need confirmation that it is a good practice) is make:

  • ftpuser => member of ftpgroup AND www-data group
  • www-data => member of www-data group AND ftpgroup AND userme group
  • userme => member of userme group AND www-data group

And then I will chmod as follows :

-[/srv/data_disk]      => userme:userme 700
        -[site1.tld]    => ftpuser:ftpgroup 750
                => ftp uploaded dirs/files = ftpuser:ftpgroup 750 
                => apache uploaded dirs/files = www-data:www-data 770 

    -[Webapps]      => userme:userme 750
        -[App1]      => userme:userme 755
                => ssh uploaded dirs/files = userme:userme 755 
                => apache created files = www-data:www-data 775 

Does it sounds safe to you? Ftpusers are chrooted so as apache...

share|improve this question

migrated from stackoverflow.com Aug 5 '11 at 22:16

This question came from our site for professional and enthusiast programmers.

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.