When multiple developers work with Apache's webroot (/var/www), the default www-data ownership creates constant permission headaches. The classic chown -R www-data:www-data approach breaks developer workflows and creates security risks from overly permissive settings.

Create a dedicated developer group that both human users and www-data belong to:

sudo groupadd webdev
sudo usermod -a -G webdev www-data
sudo usermod -a -G webdev developer1
sudo usermod -a -G webdev developer2

Then set the directory structure with proper SGID:

sudo chown -R root:webdev /var/www
sudo chmod -R 2775 /var/www
find /var/www -type d -exec sudo chmod 2775 {} \;
find /var/www -type f -exec sudo chmod 664 {} \;

For virtual hosts, maintain separation while keeping group access:

sudo mkdir -p /var/www/example.com/{public_html,logs}
sudo chown -R developer1:webdev /var/www/example.com
sudo chmod -R 2775 /var/www/example.com

Recommended permission model:

• Directories: 775 (rwxrwxr-x)
• Files: 664 (rw-rw-r--)
• Configuration files: 640 (rw-r-----)
• Executables: 770 (rwxrwx---)

Create a post-deployment script:

#!/bin/bash
DEPLOY_DIR="/var/www/example.com"
sudo chown -R developer:webdev $DEPLOY_DIR
sudo find $DEPLOY_DIR -type d -exec chmod 2775 {} \;
sudo find $DEPLOY_DIR -type f -exec chmod 664 {} \;
sudo chmod 750 $DEPLOY_DIR/logs

Additional measures for production:

sudo chattr +i /var/www/important-config.php
sudo setfacl -Rm u:www-data:r-x /var/www/example.com

For upload problems:

sudo chown -R www-data:webdev /var/www/uploads
sudo chmod -R 2770 /var/www/uploads

When working with Apache web servers in multi-user development environments, permission management becomes critical. The default www-data user needs write access to /var/www, while developers require modification rights without constantly using sudo or changing ownership.

Here's the most effective approach I've found after managing dozens of LAMP stacks:

sudo chown -R root:dev-team /var/www
sudo chmod -R 2775 /var/www
sudo usermod -a -G dev-team www-data

This solution:

• Sets root ownership for security
• Creates a developer group (dev-team) for collaboration
• Uses 2775 permissions (setgid + rwx for group)
• Adds www-data to the developer group

For name-based virtual hosts, ensure proper directory permissions:

<VirtualHost *:80>
    ServerName example.com
    DocumentRoot /var/www/example.com/public_html
    <Directory /var/www/example.com/public_html>
        Options Indexes FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>

For enhanced security in production:

# Set strict permissions for upload directories
find /var/www -type d -name "uploads" -exec chmod 2770 {} \;

# Restrict configuration files
find /var/www -type f -name "*.php" -exec chmod 640 {} \;

# Set proper ownership for cache directories
find /var/www -type d -name "cache" -exec chown www-data:www-data {} \;

Create a deployment script to handle permissions automatically:

#!/bin/bash
DEPLOY_DIR="/var/www/$1"

if [ ! -d "$DEPLOY_DIR" ]; then
    mkdir -p "$DEPLOY_DIR"
    chown root:dev-team "$DEPLOY_DIR"
    chmod 2775 "$DEPLOY_DIR"
    echo "Created and secured $DEPLOY_DIR"
fi

# Additional deployment steps...

Remember these critical points:

• Never use 777 permissions
• Regularly audit group membership (getent group dev-team)
• Consider ACLs for complex permission scenarios
• Implement proper umask settings (022 recommended)