I run a tiny web server basically just for hosting small data projects and files.  This server has a public IP address.I would like to be able to FTP in and upload files directly to /var/www/*, and so I'm considering allowing the www-data user to have a password and log in directly.  This would also avoid my having to change file ownership every time I do anything in a web directory (which I'm currently doing as root, so there's a security risk there also).Is there any security risk to allowing the www-data user to log in?  If so, what's the best alternative?
Disadvantages to having www-data able to log in
security;users;webserver
One security risk is that you can possibly kill or otherwise tackle the webserver itself (because you are then using the same user.) This is probably not what you want. Same probably when you use root, right.Two solutions:Make a subdir beneath /var/www for yourself, chown it to yourself and then use your own user. (or create a new one)Example:root@box# mkdir /var/www/joes-toysroot@box# chown joeuser:joegroup /var/www/toysroot@box# chmod u=rwx,g=rx,o=rxPut your user (your own, or a new one) in the www-data group and make sure the group has write permission on /var/wwwExample:root@box# adduser joeuser www-dataroot@box# chgrp -R www-data /var/wwwroot@box# chmod -R g+w /var/wwwP.S.: Don't use unencrypted FTP these days! Use sftp (from the ssh suite) or at least ftps (ftp over ssl).