Configure Linux file and directory ownership with chown and security best practices

Check current ownership and permissions

Use ls with the -l flag to view detailed ownership information for any file or directory.

ls -l /etc/nginx/nginx.conf
ls -ld /var/log/nginx/

Understand numeric permission notation

Permissions use numeric values: read (4), write (2), execute (1). Common patterns include 644 for files and 755 for directories.

stat -c "%a %n" /etc/passwd
644 /etc/passwd

Basic chown syntax

The chown command follows the pattern: chown user:group target. You can change the user, group, or both.

# Change user only
sudo chown nginx /var/www/html/index.html

# Change group only
sudo chown :www-data /var/www/html/index.html

# Change both user and group
sudo chown nginx:www-data /var/www/html/index.html

Recursive ownership changes

Use the -R flag to change ownership recursively for directories and all their contents.

# Change ownership of directory and all files inside
sudo chown -R www-data:www-data /var/www/html/

# Verify the change
ls -la /var/www/html/

Copy ownership from reference file

Use --reference to copy ownership from an existing file, useful for maintaining consistent patterns.

# Copy ownership from nginx.conf to new config file
sudo chown --reference=/etc/nginx/nginx.conf /etc/nginx/sites-available/mysite.conf

Change ownership with symbolic links

By default, chown affects the link target. Use -h to change the link itself.

# Change ownership of symbolic link target (default)
sudo chown www-data:www-data /etc/nginx/sites-enabled/default

# Change ownership of symbolic link itself
sudo chown -h www-data:www-data /etc/nginx/sites-enabled/default

Configure Apache web server ownership

Apache typically runs as www-data user on Ubuntu/Debian systems. Set appropriate ownership for web content.

# Set ownership for web content directory
sudo chown -R www-data:www-data /var/www/html/

# Set appropriate permissions
sudo find /var/www/html/ -type d -exec chmod 755 {} \;
sudo find /var/www/html/ -type f -exec chmod 644 {} \;

# Set ownership for web content directory
sudo chown -R apache:apache /var/www/html/

# Set appropriate permissions
sudo find /var/www/html/ -type d -exec chmod 755 {} \;
sudo find /var/www/html/ -type f -exec chmod 644 {} \;

Configure Nginx web server ownership

Nginx requires specific ownership patterns for configuration files and web content directories.

# Main configuration ownership
sudo chown root:root /etc/nginx/nginx.conf
sudo chmod 644 /etc/nginx/nginx.conf

# Site configuration ownership
sudo chown -R root:root /etc/nginx/sites-available/
sudo chown -R root:root /etc/nginx/sites-enabled/

# Web content ownership
sudo chown -R www-data:www-data /var/www/
sudo chmod -R 755 /var/www/

Configure application-specific ownership

Applications often require their own user accounts for security isolation. Create and configure dedicated users.

# Create application user
sudo useradd -r -s /bin/false myapp

# Set ownership for application directory
sudo chown -R myapp:myapp /opt/myapp/

# Set permissions for executable files
sudo chmod 755 /opt/myapp/bin/myapp
sudo chmod 644 /opt/myapp/config/*

Configure log directory ownership

Applications need write access to log directories. Configure ownership to allow proper logging without overly broad permissions.

# Create and configure log directory
sudo mkdir -p /var/log/myapp
sudo chown myapp:adm /var/log/myapp
sudo chmod 775 /var/log/myapp

# Configure log rotation ownership
sudo chown root:root /etc/logrotate.d/myapp

Configure shared group ownership

When multiple users need access to files, use group ownership with appropriate permissions instead of overly permissive settings.

# Create shared group
sudo groupadd webdevs

# Add users to group
sudo usermod -aG webdevs user1
sudo usermod -aG webdevs user2

# Set group ownership and permissions
sudo chown -R :webdevs /var/www/shared/
sudo chmod -R 775 /var/www/shared/

# Set group sticky bit for new files
sudo chmod g+s /var/www/shared/

Principle of least privilege

Grant only the minimum permissions required for functionality. Most files need 644 permissions, directories need 755.

# Correct pattern for web content
sudo find /var/www/html/ -type f -exec chmod 644 {} \;
sudo find /var/www/html/ -type d -exec chmod 755 {} \;

# Executable files need execute permission
sudo chmod 755 /usr/local/bin/myapp

Secure sensitive configuration files

Configuration files containing secrets should have restrictive ownership and permissions.

# Database configuration with credentials
sudo chown myapp:myapp /opt/myapp/config/database.conf
sudo chmod 600 /opt/myapp/config/database.conf

# SSL private keys
sudo chown root:ssl-cert /etc/ssl/private/example.com.key
sudo chmod 640 /etc/ssl/private/example.com.key

Configure systemd service ownership

Service files should be owned by root with appropriate permissions to prevent unauthorized modifications.

# Service file ownership
sudo chown root:root /etc/systemd/system/myapp.service
sudo chmod 644 /etc/systemd/system/myapp.service

# Reload systemd after changes
sudo systemctl daemon-reload

Debug ownership issues

Use these commands to identify ownership problems:

# Check what user a service runs as
sudo systemctl show -p User,Group nginx

# Find files with specific ownership
sudo find /var/www/ -user www-data -group www-data

# Find files with problematic permissions
sudo find /var/www/ -perm 777