1

I run an Ubuntu server for running many Wordpress websites. Every website is uploaded and managed by a separate system user. System users are allowed to FTP but not SSH into my server. And they are chrooted into their folders when they log in. Apache is run by www-data user.

Wordpress user get an error while uploading an image or document:

image.jpg has failed to upload. Unable to create directory wp-content/uploads/2019/08. Is its parent directory writable by the server?

Similary, users get an error while installing new plugins.

Changing owner of the wp-content folder may be a temporary solution but it does not sound very secure to me. Who should be the owner of wp-contents folder for best security while Wordpress can still function as needed?

0

1 Answer 1

4

By default, all files added by the Apache itself will be owned by the server's user, in your case www-data. But since your users use FTP to deploy, those files are owned by them, and it makes the Apache scream for your attention. Changing the ownership of wp-content folder to www-data isn't insecure at all, as this is a default user used only by the Apache, but as you said, it is only a temporary solution.

For a permanent solution, I'd recommend Tom's solution from this post on ServerFault:

Attempting to expand on @Zoredache's answer, as I give this a go myself:

  • Create a new group (www-pub) and add the users to that group

    groupadd www-pub 
    usermod -a -G www-pub usera    # must use -a to append to existing groups
    usermod -a -G www-pub userb
    groups usera    ## display groups for user
    
  • Change the ownership of everything under /var/www to root:www-pub

    chown -R root:www-pub /var/www    # -R for recursive
    
  • Change the permissions of all the folders to 2775

     chmod 2775 /var/www 
    

    2=set group id, 7=rwx for owner (root), 7=rwx for group (www-pub), 5=rx for world (including apache www-data user)

    Set group ID (SETGID) bit (2) causes the group (www-pub) to be copied to all new files/folders created in that folder. Other options are SETUID (4) to copy the user id, and STICKY (1) which I think lets only the owner delete files.

    There's a -R recursive option, but that won't discriminate between files and folders, so you have to use find, like so:

    find /var/www -type d -exec chmod 2775 {} +
    
  • Change all the files to 0664

    find /var/www -type f -exec chmod 0664 {} +
    
  • Change the umask for your users to 0002

    The umask controls the default file creation permissions, 0002 means files will have 664 and directories 775. Setting this (by editing the umask line at the bottom of /etc/profile in my case) means files created by one user will be writable by other users in the www-group without needing to chmod them.

Test all this by creating a file and directory and verifying the owner, group and permissions with ls -l.

Note: You'll need to logout/in for changes to your groups to take effect!


EDIT:
If you are serious about running a hosting server for different clients, perhaps consider setting up and running your PHP differently then it is by default (as mod_php). I'd recommend running it as PHP-FPM service, as it can be tweaked to use the user's permissions, which will further prevent PHP server to have a full ownership and rights over literally all files from the web root.

This is an excellent article explaining different ways for running PHP. I am not an expert on the matter, and you can get more help from the ServerFault.

2
  • with this solution; a malicious code in a plugin will be able to write on any of the files in my Wordpress installation, right? And even, on the files of another website?
    – mustafa
    Commented Aug 27, 2019 at 0:23
  • @mustafa On any server configuration, unless you custom tweak permissions file by file, any code run by the server will have pretty much full permissions with all the files from the root dir.
    – djboris
    Commented Aug 27, 2019 at 10:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.