I would like to create a new user with read/write privileges ONLY in the /var/www/ directory including all sub-directories. The /var/www/ is owned by a group called www-data.

Best way to do it I guess is with SFTP. I already have SSH access as root. Many other answers relating to restricting SFTP access are related to the /home/ directory and require to change ownership of directory to root and I don't know if it's a good idea to do that also on the www directory.

2 Answers 2


You can create a user, set its home directory to /var/www/ and add him to the www-data group. If you want the files he will create belongs to the www-data group, you'll have to add the "s" bit to the www directory's mod.

# useradd -m /var/www -g www-data
# chmod g+s /var/www

Or did I missunderstand the question? Maybe you want that this user can't read any other directory? In this case you can chroot him: http://how-to.linuxcareer.com/how-to-automatically-chroot-jail-selected-ssh-user-logins

If you want to use SFTP: https://bensmann.no/restrict-sftp-users-to-home-folder/

s bit: http://en.wikipedia.org/wiki/Chmod#Special_modes


  • Yes I want to do both chroot the /www directory and use SFTP, but the problem is that I don't know if it's a good idea to do that on /www. All solutions I have seen so far always refer to new directories created for that purpose, not an existing /www directory wich already has wordpress on it.
    – Jaume Nuez
    May 29, 2015 at 6:57
  • thanks for those great links. I'll chroot the user, but to do that seems that I have to change ownership of the www to root. Is it ok to do that?
    – Jaume Nuez
    May 29, 2015 at 7:33
  • Why would you do that?
    – Dano
    May 29, 2015 at 8:00
  • According to all the literature I've read, also in your first link... "every folder leading up to and including the home folder must be owned by root, otherwise you will get the following error after logging in:" Write failed: Broken pipe Couldn't read packet: Connection reset by peer In my case is not the /home folder but the /www EDIT: your second link.
    – Jaume Nuez
    May 29, 2015 at 8:22
  • Oh yeah, my bad. Well you can chown root, but make sure that www-data has the right to write. Otherwise Wordpress will not work. If you keep www-data group + chmod 775 it should work.
    – Dano
    May 29, 2015 at 8:24

A better way to do this is to use the chroot feature of sshd and the sftp subsystem.

Given a DocumentRoot setting of /var/www-sites/example.com/html

Create a group, named something like "chrootwebusers"

root@hostname:~# addgroup chrootwebusers

Add a user and set their home directory and some other options -

useradd -g chrootwebusers -d /var/www-sites/example.com -s /bin/false theusername
mkdir -p /var/www-sites/example.com/html
chown theusername.www-data /var/www-sites/example.com
chmod -R 750 /var/www-sites/example.com
chmod g+s /var/www-sites/example.com
passwd theusername

This adds the user named theusername with group membership in your chrootwebusers group, with a home directory of /var/www-sites/example.com and read/write access to everything below it.

The chmod g+s /var/www-sites/example.com works with the www-data group being the owning group. The use of the setgid bit on a directory makes any new files/directories created inside of it to keep the same group ownership as the example.com directory. This means the user the webserver runs as will always be able to read the files all the way down (be aware of this!)

Next, edit the /etc/ssh/ssdh_config file. Fine the line that specifies the sftp subsystem and comment it out-

#Subsystem sftp /usr/lib/openssh/sftp-server

And add in a reference to the internal-to-sshd sftp subsystem

Subsystem sftp internal-sftp

Finally, at the bottom of the file add

Match Group chrootwebusers
    ChrootDirectory /var/www-sites
    ForceCommand internal-sftp -u 0027

So... how does this all work? The sshd internal-sftp subsystem waits for a login from someone who has membership in the chrootwebusers group. When that happens, it will chroot them so that what you see as /var/www-sites they see as / . They will be able to see the example.com directory, and change into it and read/write files both there and in the DocumentRoot of /var/www-sites/example.com/html - but they will see it all as /example.com/html. The -u 0027 option sets the umask so any new files/directories created will have 640/750 permissions, and the setgid trick we used previously will make the owning user be theusername and the owning group the www-data user (remember the bit about the webserver being able to read all the files)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .