2

I just rented a VPS, in order to run a web server. I installed LAMP utilities and everything work.

I have actually only 1 user (root). This means everytime I want to connect to my server to modify files under /var/www/, I'm using the root account. This does not seem good to me (even if I use sFTP).

I would like to know if I have to use special user to manage my web files. For example, create jsmith and run chown jsmith /var/www/index.html ?

TomatoGuy
  • 29
  • 1

2 Answers2

3

Using root as a general purpose user account is just generally unsafe. Bad things can happen too easily (I once did rm -rf ~ when I was in a root shell). So, you are correct, create a user.

Using chown, if there is only one user messing with the server data files, seems fine. The answer to this question goes into some details on how to set it up. It does a nice job discussing the security ramifications that come from making web server data files writable by the web server.

Neil Smithline
  • 14,842
  • 4
  • 39
  • 55
0

Are multiple ways to do this.

  1. Create your own group and add apache and ftp (if you want to use for external upload) user on it. Then change the permissions on /var/www folder to use your group (see this: https://serverfault.com/questions/184548/ftp-and-apache-permission-issues).

  2. Add your user(jsmith) to apache group (useradd -G www-data jsmith) and set write on group on all folders from /var/www. (chmod g+w /var/www -R).

  3. Set your own group (jsmith) to all files and folders from /var/www and give them write right for your group(chmod g+w /var/www -R; chown :jsmith /var/wwww -R). You also should have access on that folder. If you need ftp and your ftp servers is chroot-ed, then this solution it will not work.

  4. The most unsecured one, but most trouble free: set a password for your apache user, add /bin/bash as shell for your apache user, and you are ready.

Community
  • 1
Sacx
  • 684
  • 5
  • 12
  • I think that giving the Apache server write permission is risky. It opens the door for a remote attach via the server. – Neil Smithline Apr 20 '15 at 13:06
  • Is true, but I presented all the methods (what I can think in this moment), to let the user choose :). – Sacx Apr 20 '15 at 13:15