This summarizes how I currently set up my servers so that I can have multiple developers accessing certain client files, but retain control on which clients. The key to this whole process is groups.
Users
Create user accounts for your developers.
# useradd developer1
# passwd developer1
# useradd developer2
# passwd developer2
Groups
Create groups that section off your clients. For example.
# groupadd client1
# groupadd client2
Add apache to your groups
The web server is going to need access to the files so we will add apache to any groups we create for this purpose.
# usermod -a -G client1 apache
# usermod -a -G client2 apache
This will add apache to the groups client1 and client2.
Add developers to your groups
Your developers need to access your client files as well so we assign them to the groups. This will assign developer1 -> client1 and developer2 -> client2. Fun stuff.
# usermod -a -G client1 developer1
# usermod -a -G client2 developer2
Note: the “-a” appends, if you don’t have this option, then it overwrites the users groups list, not good.
You could also section off your groups in other ways, such as by website.
DocumentRoot Folders
The web server folders will be located at /var/www/. So you will have :
/var/www/client1
/var/www/client2
Setting the setgid bit
# chmod 2770 /var/www/client1
# chmod 2770 /var/www/client1
Assigning User and Group ownership to the directories
This will have to be done by root, because you cannot assign ownership to another person unless you are root. Also, I created a dummy user of “www” to be the user owning the files, it doesn’t matter who owns the files because we are not relying on that part of the permissions.
# chown www:client1 /var/www/client1
# chown www:client2 /var/www/client2
The permissions on these folders will now look like
#ls -l /var/www/
drwxrws--- 6 www client1 4.0K Apr 14 15:28 client1
drwxrws--- 6 www client2 4.0K Apr 14 15:28 client2
This will ensure that all files and folders created below this directory
Result
Developer1 can access Client1′s files, change them, create new folders/files, but cannot get to Client2′s files. Developer2 has the visa-vers result.
NOTE: any new file created by the developers will be owned by the developer and the group (e.g. the ownership will be developer1:client1). This is not a problem since we are not really checking user level permissions.
Helpful commands
Set the setgid on all folders.
# find ./* -type d -print0 | xargs -0 chmod 2775
Set all files to appropriate permissions
# find ./* -type f -print0 | xargs -0 chmod g+rw
