Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a server with a user named deploy-user and have written a backup script to backup a number of websites associated with this user. However one of the sites I'm trying to backup has a directory /home/usera/web/www.example.com/some/random_dir is owned by apache-data-user.

What permissions would I give deploy-user to be able to backup that directory. Options I am aware of are either:

  • Running the script as root, which I don't really want to do.
  • Adding apache-data-user and deploy-user to the same group. But then apache-data-user will have to many permissions.

Has anyone got a suggestion of the best way to backup this directory?

share|improve this question

4 Answers 4

find default apache user's group in /etc/groups

and add deploy-user to that group

share|improve this answer

If you don't want to put deploy-user and apache-data-user into the same group then ACL suits you best.

share|improve this answer

Option 2 is definitely the way to go, unless you want to use ACL. Note that such a group will probably only need read permissions to the directory you're referring to.

Another option would be to use sudo to give the deploy-user some very restricted rights to only perform backup operations as root.

share|improve this answer

If you have access control lists enabled, give deploy-user the right to read /home/usera/web/www.example.com/some/random_dir and its contents. To enable ACLs, you may need to add the acl option to the entry for the filesystem in /etc/fstab and install your distribution's acl package.

Under Linux, the following commands give deploy-user the right to read and traverse the whole hierarchy rooted at /home/usera/web:

setfacl -d -m user:deploy-user:rx -R /home/usera/web
setfacl -m user:deploy-user:rx -R /home/usera/web
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.