Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.
By Passiday on
I have set up Apache2 site (currently local dev) with Drupal 8 multisite, following this guide: https://www.drupal.org/docs/8/multisite/drupal-8-multisite
The system where all this is running is in a Docker container, based on Ubuntu.
The Drupal was installed by root user, and the associated Apache site user is www-data.
To maintain tight security, I'd like to keep the site's file and directory permissions as conservative as possible. Of course, the site must accept new images and downloadable files (like pdf, zip, etc.), and also allow to install modules without asking for ftp connection. In fact, I'd like to write a shell script that would let me switch on/off the module installation access, so that I could enable it only when needed to extend the platform.
After some struggle to change the ownership of "files" directory (recursively) to www-data:www-data, I gave up and changed the whole site ownership to www-data:www-data. And I feel bad about it because it is definately not the best practice. www-data should have write access only to certain locations and that's it. All the other files and directories should be owned by other user and www-data should have only read permission on them.
So, I am looking for some guide which folders in the whole tree should be write-accessible to the www-data user, and best if explained why.
