Maybe I should rephrase - what is the most secure way to accomplish my needs?


I am using WinSCP to modify my Apache document_root. The directory /var/www/html has an owner and group of root. Using WinSCP I must log in as root to modify these files since sudo -s requires a password. I don't want to login with root remotely so what I'd like to do is add a sudoer with a no password requirement for /var/www/html. Is that possible?

  • 2
    You probably want to just set POSIX ACL's to let your particular non-root users edit the files directly without having to go through sudo at all. – Bratchley Mar 25 '15 at 15:31
  • For example: setfacl -m u:<nonRootUser>:rwx /var/www/html or if you're using a GUI on the server-side you can try to install eiciel and manipulate the ACL's through the directory/file properties tab in GNOME. – Bratchley Mar 25 '15 at 15:32

Sudo isn't the right tool for this job. It controls what commands you can run, not what files you can access.

The right tool for the job is file permissions, with access control lists if the Unix traditional user/group/other permissions aren't enough.

Create a group, let's call it webroot, and make it own the directory /var/www/html and the files in there.

sudo addgroup webroot
chgrp -R /var/www/html
chmod -R g+ws /var/www/html

The s bit on directories cause files to inherit group ownership from the directory. You'll also need to ensure that the files there are group-writable.

If you want to be able to access /var/www/html with the account you're using to upload files, add that account to the webroot group:

sudo adduser iusemagentonow webroot

If you have trouble maintaining group ownership and group write permission on newly created files, use ACL instead of chgrp.

sudo setfacl -d -R group:webroot:rwX /var/www/html
sudo setfacl -R group:webroot:rwX /var/www/html

Take care that files in /var/www/html must not be writable by the user and group running Apache or whatever web server you're using. The user running the web server must not be allowed to write any files except for data files that are supposed to be updated by the web application. In particular, don't allow the web server to write any executable file, as that tends to make exploits easy.

  • Forgive my understanding of security, but isn't there a security reason that the default setup of Apache on this setup came with group and ownership of root - Apache uses the user and group of apache. Can I assign give a user read/write access to this root:root directory while locking them into it and revoking sudo commands? – TylersSN Mar 27 '15 at 12:31
  • @iUseMagentoNow The important thing is that the owner must not be the apache user. Making the owner the user or at least the group who updates the website makes sense. Since who maintains which part of the website is very much site-dependent, Apache can't come with a better default than root (root being the user who decides which other users to delegate website maintenance to). – Gilles 'SO- stop being evil' Mar 27 '15 at 12:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.