So I've searched this a lot and found conflicting answers.

I would appreciate, for everyone's sake, if someone could come up with a fully reasoned and cited answer for how to set ownership / permissions of /var/www/html

e.g. lets say you want to access the directory using sftp but your user cannot write files there by default. What is the correct solution to this, from a security standpoint.

(Let's assume a LAMP environment)

closed as unclear what you're asking by Rui F Ribeiro, Jeff Schaller, Romeo Ninov, Kiwy, Christopher Mar 22 '18 at 15:06

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    If you're trying to host multiple vhosts for clients, you can grant their users ownership/permissions to their respective doc root folders. On my server(s), I create a folder "/www" and make subfolders for each vhost. All of the vhosts are mine, but if you have clients you can make them the owners of their doc roots. – user208145 Mar 21 '18 at 23:15
  • question that's start with is the correct or what is the best solutions are often opinion based, in this case you could put a folder by user and move the file with a script after inotify event or you could do groups and handle permission... what is your goal, what do you want to do precisely this would helps us to answer. – Kiwy Mar 22 '18 at 9:37

From a security stand point, for me, this directory, as well as any directory that the webserver needs to go to should be set in such a way that the webserver is not the owner of the files/directories and in such a way that it has no rights to write in any directory/file.

By doing so it means, whatever breach you have in the server, would never result in more than a DOS and an exfiltration, files would not be able to be written to by the webserver.

Of course, in real life things may get more complicated as:

  • some CGI/application inside the webserver may need to have write access somewhere, for example to store session data if not done with a database
  • the webserver itself typically needs write access somewhere to write logfiles, etc.
  • in some setup, and it can have positive security effects, each application inside the webserver could run under another UID than the webserver itself. The juggling on ownership and rights could become complicated. This is probably why you can see many times online many people saying: just put rwx everywhere and it will work. Of course if you give everyone every right it "works" but they are consequences security wise.

So if you have like users connecting to your server to upload new files through SFTP so that they can be served by a webserver, I would:

  • make each user own its specific directory with full rights for them
  • make the webserver main group be the group of each user specific directory, with rx right for it
  • no rights at all for other users

By doing so, each users sees only its own files and nothing else (SFTP has also the option of chrooting for added security but this comes with its own complexities), and the webserver has access to all files only for reading.

Inside each directory you can have all files owned by the group of the webserver or even put rx for anybody, since that will be protected by the top directory having no rights at all for other users than the owner or the webserver.

Not the answer you're looking for? Browse other questions tagged or ask your own question.