I run a tiny web server basically just for hosting small data projects and files. This server has a public IP address.

I would like to be able to FTP in and upload files directly to /var/www/*, and so I'm considering allowing the www-data user to have a password and log in directly. This would also avoid my having to change file ownership every time I do anything in a web directory (which I'm currently doing as root, so there's a security risk there also).

Is there any security risk to allowing the www-data user to log in? If so, what's the best alternative?


One security risk is that you can possibly kill or otherwise tackle the webserver itself (because you are then using the same user.) This is probably not what you want. Same probably when you use root, right.

Two solutions:

  1. Make a subdir beneath /var/www for yourself, chown it to yourself and then use your own user. (or create a new one)


    root@box# mkdir /var/www/joes-toys
    root@box# chown joeuser:joegroup /var/www/toys
    root@box# chmod u=rwx,g=rx,o=rx
  2. Put your user (your own, or a new one) in the www-data group and make sure the group has write permission on /var/www


    root@box# adduser joeuser www-data
    root@box# chgrp -R www-data /var/www
    root@box# chmod -R g+w /var/www

P.S.: Don't use unencrypted FTP these days! Use sftp (from the ssh suite) or at least ftps (ftp over ssl).

  • If I pursue solution 1, how do I make apache serve up the webpages from those subdirectories? Currently all permissions on /var/www/* are set to www-data. Also for solution 1, is it safe to do this for users with sudo root privileges? – Ari B. Friedman May 25 '13 at 11:02
  • Added a few example commands to my answer. I hope they clarify things? – Elrond May 25 '13 at 11:08
  • Your original answer was clear enough, but when I go for solution 1, visitors to the website then get Forbidden: You don't have permission to access ... on this server. Why is why they were owned by www-data in the first place. – Ari B. Friedman May 25 '13 at 11:11
  • 1
    Permission denied is strange for this, really. Make sure to have the read (for files) and read/execute (for directory) permissions on the files/dirs for group and other. See my chmod for the directory part. – Elrond May 25 '13 at 11:15
  • Solution 1 is pretty much how any shared webhost does it. (There are obviously going to be differences because of the lower degree of general trust in such an environment, but that is more or less what it boils down to.) – a CVn May 25 '13 at 22:52

Daemon processes generally are unable to login for a number of reasons. Among other security is a significant issue. www-data is assumed to be available on your system if you are running a web servers on many platforms. If I can log on to that user id, I can easily compromise your web-server and/or its content. (Think serving up malware.)

It is best not to have www-data own the files. What is important is that www-data be able to read the files. Consider creating a userid with the same group and allow that user to FTP in. To improve security, provide as few directories that the web server can write as possible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.