Member Avatar for slacke

I need to enable ftp access on some web directories in apache. What is the best way to do this?

My apache server is running on linux. It runs as user wwwrun and group www.
What should be the permissions and who should be the owner of the web directories and files?

What I need to do is to enable ftp administration of one of these web directories. It contains one free Customer Relationship Management web application. It stores data in mysql. It has lots of directories and files. To tell the truth I do not know much this application. This application is managed by one third party group.
I tell them that I make ftp access to the complete directory and asked them to set the right permissions on each file.

My ftp (pureftpd) server runs as ftpuser and ftpgroup. When the ftp client connects it cannot make any changes in files because the ftpuser do not have any permissions.
What is the best way to allow ftp admin on it?

  • 1 Contributor
  • 1 Reply
  • 219 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by slacke

Dani AI

Generated

As 's follow-up indicates, the immediate permission problem was resolved. The notes below summarize durable best practices to keep a site manageable and reduce risk when a third party is given FTP access to a web application that stores data in MySQL.

Keep write access minimal. Grant write only to the specific upload/cache/tmp directories the app needs; keep code and configuration files read-only for the web process. Sensitive files (database credentials, config files) should be tightened to 640 or 600 and owned by a deploy/administrator account with the web group allowed read only where necessary.

Use a group-based workflow so uploads remain usable by both the FTP account and the webserver. Example commands (adapt names to the environment) set ownership, make directories inherit the group, and give reasonable defaults:

chown -R deploy:www /var/www/site
find /var/www/site -type d -exec chmod 2775 {} \;
find /var/www/site -type f -exec chmod 664 {} \;
chmod 640 /var/www/site/config.php

If finer control is needed, apply POSIX ACLs to give write only to particular subtrees (uploads/cache) and set a default ACL so new files inherit the ACL:

setfacl -R -m g:www:rwX /var/www/site/uploads
setfacl -R -m d:g:www:rwX /var/www/site/uploads

Operational and security notes: plain FTP sends credentials in clear text—prefer SFTP or FTPS and chroot/limit accounts to required trees. Configure the FTP/SFTP umask so uploaded files are group-writable (umask 002) or ensure the FTP account is in the web group. Avoid making the webserver user own writable application files; consider process isolation (php-fpm pools, suexec) to reduce the blast radius of a web vulnerability. If SELinux/AppArmor is active, verify file contexts/labels so Apache can read/write only the intended paths. Finally, for repeatable safe deployments, move from manual FTP edits to a controlled deploy pipeline (git/rsync over SSH / CI).

Member Avatar for slacke

The permission related issue is solved now.
I moved the ftpuser into www group under which the apache runs and set the permissions for the web directory so that group can change them.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.