User access to FTP and at same time set www-data as owner/group
This guy Tom deserves a medal for this post on ServerFault
Setting group ID the way he explains made it work!
Attempting to expand on @Zoredache's answer, as I give this a go myself:
Create a new group (www-pub) and add the users to that group
groupadd www-pub usermod -a -G www-pub usera # must use -a to append to existing groups usermod -a -G www-pub userb groups usera ## display groups for user
Change the ownership of everything under /var/www to root:www-pub
chown -R root:www-pub /var/www # -R for recursive
Change the permissions of all the folders to 2775
chmod 2775 /var/www
2
=set group id,7
=rwx
for owner (root),7
=rwx
for group (www-pub),5
=rx
for world (including apache www-data user)Set group ID (SETGID) bit (2) causes the group (www-pub) to be copied to all new files/folders created in that folder. Other options are SETUID (4) to copy the user id, and STICKY (1) which I think lets only the owner delete files.
There's a
-R
recursive option, but that won't discriminate between files and folders, so you have to use find, like so:find /var/www -type d -exec chmod 2775 {} +
Change all the files to 0664
find /var/www -type f -exec chmod 0664 {} +
Change the umask for your users to 0002
The umask controls the default file creation permissions, 0002 means files will have 664 and directories 775. Setting this (by editing the
umask
line at the bottom of/etc/profile
in my case) means files created by one user will be writable by other users in the www-group without needing tochmod
them.Test all this by creating a file and directory and verifying the owner, group and permissions with
ls -l
.Note: You'll need to logout/in for changes to your groups to take effect!
Related videos on Youtube
Rob
Updated on September 18, 2022Comments
-
Rob over 1 year
In order for wordpress to read/write the owner of the files/folders need to be www-data.
Now the problem is that if the owner is www-data of group filetransfer (www-data:filetransfer) then the FTP user ftpclient1 can login but does not have write permission to folders set to www-data:filetransfer because he's not the owner.
How can I make this work?