Adding Apache to User Group

Question

We have a small LAMP server running Ubuntu 12.04 LTS which contains a few sites. Access to the vhosts directories is set to root:AndSpecialSFTPGroup. This works fine in general. However, some of the sites run on a CMS which need write access to particular folders. This is now not working, because the Apache user is www-data.

Simple question: Is OK to add the www-data to the AndSpecialSFTPGroup group in order to grant it rwx permissions. Or is this the wrong approach altogether.

Or should the owner of the website folders be www-data?

Solution 1

There are a few ways you could approach this, but you can add www-data to that group like so:

sudo usermod -a -G AndSpecialSFTPGroup www-data

As far as "Is it the right way to do this?" Like I said, there are many ways to accomplish this, but it's similar to asking me what's the best way to arrange your desk. In many facets of IT, development, and OS, there are choices left up to preference.

This is the way I prefer to handle permissions like this because if I screw something up, I can easily remove the user from the group again. You might like using chown to give all the files to www-data, or something else altogether.

My way is a right way to do this, which is why I most likely won't get flagged for being subjective, but there are other ways. (Like I mentioned chown, create another user, chmod to change the permissions overall, etc...)

Solution 2

This is an old post, but I got to it via Google as the top result for "ubunut add apache to a group".

Since the www-data user already exists the command should be usermod, which is used to modify an existing user.

sudo usermod -a -G AndSpecialSFTPGroup www-data

You can then confirm the change by executing

id www-data

Comments

[Adrian Wagner]

Thanks, Kyle. What I am mostly 'wondering' about, is if this is an appropriate approach....

[Rinzwind]

It is @AdrianWagner

[Kyle Macey]

@AdrianWagner See my updated answer

[Adrian Wagner]

Thanks again, Kyle. That was the answer I needed. I knew I could solve it this way, but was wondering if there were be no-no's attached to it.

[guntbert]

usermod is always a bit dangerous -- be careful to use -G and not -g.

[guntbert]

useradd (like usermod) is always a bit dangerous -- be careful to use -G and not -g.

[M Katz]

Just a note that it appears to be necessary to restart apache with sudo service apache2 restart in order to apply the permission of the group it's been assigned to.