SSH / FTP user permissions

Juc1 · 10-27-2012, 12:48 PM

Hi all,

My Debian 5 root / administrator can see all directories. My website files are stored in /var/www/vhosts/example.com/httpdocs. I have created a user (jim24) who can get as far as /var/www/vhosts/example.com/httpdocs but then can't open the httpdocs directory - permission denied.

Can anyone please tell me how I give all relevant permissions to jim24 for the httpdocs directory?

Thank you

KinnowGrower · 10-27-2012, 05:02 PM

You can add user jim24 to the group, that owns httpdocs directory. I am assuming group has read and execute permissions at least on httpdocs

to add jim24 to the group

Code:

usermod -a -G groupname jim24

Hope it helps

Juc1 · 10-27-2012, 05:21 PM

Quote:

Originally Posted by KinnowGrower

You can add user jim24 to the group, that owns httpdocs directory. I am assuming group has read and execute permissions at least on httpdocs

Ok thanks but how can I see which group owns the httpdocs directory?

Juc1 · 10-28-2012, 06:10 AM

Quote:

Originally Posted by Juc1

Ok thanks but how can I see which group owns the httpdocs directory?

I think this says that the directory /var/www/vhosts is owned by the group 'root'...

Code:

$ ls -l /var/www/vhosts
total 16
drwxr-xr-x 10 root root 4096 Dec 15  2010 chroot
drwxr-xr-x  5 root root 4096 Oct 21  2010 default
drwxr-xr-x 14 root root 4096 Oct 10  2011 example1.com
drwxr-xr-x 14 root root 4096 Jan 19  2011 example2.com
$

So if I add my user to the group 'root' then he should have all permissions for the website directories example1.com, example2.com etc?

Thanks

Wim Sturkenboom · 10-28-2012, 09:40 AM

I think it's a bad idea to make any ordinary user a member of the root group.

You might be able to use ACLs to solve your problem. Because the directory is owned by root, run the below command as root

Code:

setfacl -m u:jim24:rwx /var/www/vhosts/example1.com/httpdocs

It's a modification on commands I used in http://www.linuxquestions.org/questi...-group-730046/ to allow apache to write somewhere in a user's home directory. If you get errors like "operation not permitted", check post #3 in the above thread.

PS
You might need to install some SW to support ACL. E.g. Ubuntu 10.04 does not seem to support it out-of-the-box while 12.04 does.

PPS
If ACLs are too much work to get going, I would change the group of the directory /var/www/vhosts/example1.com/httpdocs from root to something like www-users (and create that group as well) and make jim24 a member of that. Change the permissions on that directory to 775 in that case.

KinnowGrower · 10-28-2012, 06:40 PM

if /var/www/vhosts/httpdos is Document root for Apache, it would also be good, if owned by www-data user and www-data group. So as per my knowledge, if you change ownership for that directory and make user jim24 member of www-data group it would be ok.