Are my web server permissions for uploading correct?
- by user1699176
I'm on debian and I have my website in the directory /srv/www/mysite.com/public_html
I set chown for www-data:www-data on /srv/www.
I have root disabled and created a sudo user which is id 1000:1000. I would also like to use this user to upload to /srv/www so I added my sudo user to the www-data group. I originally got a message saying that I didn't have permissions to upload a file to that directory. After playing around with multiple permissions for a while I finally was able to upload properly, but I'm not sure if this set up is correct. I'm hesitant to change it for now since it actually works, so I thought I'd ask for advice.
I think what I ended up doing was this:
sudo chown -R www-data:www-data /srv/www
sudo chmod g+s /srv/www
sudo usermod -aG www-data myuser
sudo chgrp -R www-data /srv/www
sudo chmod -R g+w /srv/www
When I was finally able to successfully upload a file (with FileZilla) it showed the owner as myuser myuser. Shouldn't it have been www-data myuser?
My question is whether this is correct and if there are any potential security issues? For example, I wasn't sure if I was actually supposed to use "myuser" to own the /srv/www directory instead sudo chown -R myuser:myuser /srv/www or maybe sudo chown -R www-data:myuser /srv/www
If you need more info, let me know, thanks.
