Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a isolated local test/dev server I have elevated the nature of the www-data user to enable a smooth workflow for using Dropbox in a web/webapp development pipeline.

It has worked quite smoothly in my initial testing, and while I don't plan to move it to a production environment - I'm curious if it would send up any major red flags to the security pros if it were moved onto a production server.

The details:

Immediately upon installing Ubuntu 12.04 I deleted and recreated the www-data user with:

sudo deluser –remove-home www-data
sudo adduser --system --disabled-login --disabled-password --group www-data

This provides me the /home/www-data environment in which Dropbox can be installed and operated with the permissions exactly how Apache/Nginx/PHP/etc expect them to work.

To elaborate, Dropbox operates in the user space with the following configuration:

/home/[USER]/.dropbox-dist - is where the libraries/executables are housed
/home/[USER]/.dropbox - is where it caches data and keeps config data
/home/[USER]/Dropbox - is where it keeps the synchronized data

It's odd, but it is what it is. Working in this configuration means that all synced data receives the permissions of the user that runs it. Rather than have to putz around with changing permissions manually or pseudo-automatically at the server every time files on the workstation are updated, I've opted to have www-data just run the daemon itself.

Aside from the obvious concerns of running a proprietary application with network access and a less than conventional operating mentality... does upgrading the www-data user to one with a somewhat higher presence on the machine open up security issues I have not foreseen?

Many thanks.

share|improve this question

In general this is a flawed approach to permissions. You should keep www-data, and then create a new account "dropbox", which performs the required dropbox actions on behalf of the web application. One implementation of this is that a php application could run commands as that user only when needed and perform all other actions as the usual www-data.

share|improve this answer
My troubles in previous attempts to make this work with a dropbox user, were that all files synced had: dropbox:dropbox ownership and -rw-rw-r-- permissions. Attempts to give www-data appropriate access to the contents of that data by adding group www-data to dropbox, or adding group dropbox to www-data always resulted in files being unavailable to the www-data user. – JDex Apr 27 '13 at 19:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.