Linux – Allow Permissions for Multiple FTP Users to Edit Public HTML Folder – Linux

ftplinuxpermissions

On a dedicated server hosting one website, running Linux with no control panel, I'm trying to grant permission for multiple users to edit the public HTML folder (/var/www/html/).

I want to make sure I do this the best way, I imagine if I set the permissions loosely via CHMOD, it will allow anyone who can reach the folder via FTP to change it. Is the solution to set up a wheel group, add the intended users to the wheel group, and then set the permissions to the wheel group?

Right now, only one user can edit the public HTML.

Best Answer

Your solution is pretty close to what I'd recommend, but why do you specifically reference the wheel group? On many distributions the group wheel has full access to the sudo command granting then full root access to the system.

Let's assume you make a new group called webadmins:

groupadd webadmins

Then you want to set the proper permissions to allow your webadmins to make changes:

chown root:webadmins /var/www/html -R

The -R will set the permissions on all existing files. One issue that's common is if joe creates a file in /var/www/html it will, by default, be owned by joe and grouped to joe's default group. We can remedy this by setting the SETGID bit on the parent directory so new files will be grouped to webadmins by default:

chmod g+s /var/www/html

One last issue is that your webserver will need to access these files as well. I, personally, don't like to leave global read access on /var/www/html because of the likelihood that someone will drop a .php script in there, so I set the directory to 770:

chmod 770 /var/www/html

And then I add the apache user (www-data on RedHat systems, typically) to the webadmins group:

usermod -aG webadmins www-data

Hope that helps!

Related Topic