0
I have messed around with assigning different users and groups to the files in /var/www
, but each way that I've tried so far ends up being overly complicated and error-prone. I'm looking for a simple and repeatable pattern that differs minimally from the default file-system settings (permissions, sticky bits, ACLs, etc.) Once I get this nailed down, I plan to replicate it across multiple servers over time.
My situation is that I have a web application that lives in /var/www/foo
and needs to be uploaded via SFTP. I'm planning on having git-ftp do the actual uploads. All files need to be readable by Apache. Some folders, and any subfolders created by the application, need to be writable by Apache. I have a single user account on the server in question that does not belong to any special groups at the moment, but does have full sudo
access. There will be multiple uploads over time and after each upload, I need to run a script that may create, modify, or delete files.
What is the least invasive way to get the files in place and not run into any permissions issues, either during the upload or at run-time?
In case it helps, I'm setting up Laravel applications on Debian, though the pattern that I'm looking for should hopefully generalize beyond that framework, the language it runs on, and that distribution.
Transfer files through SSH. – Ramhound – 2017-02-24T18:36:56.303
Yes, that is implicit in "SFTP". – Michael Cordingley – 2017-02-24T18:40:33.663
The title is misleading. This is not a question about uploading (to which the best answer would be
ssh
). I think it may be about file permissions, though am not 100% sure. – ctrl-alt-delor – 2017-02-24T18:40:47.970@richard Updated. Is that better? – Michael Cordingley – 2017-02-24T18:41:40.383
Git support pushing directly over SSH. just add apache to SSH group(ssh user's group) and set www's directory-root permission as 755 with ownership
ssh_user:www-data
. If you need some directory be writable by apache, then change permissions to 775 – Alex – 2017-02-24T18:44:54.377Have you looked at default permissions use access control lists? You can make group, read, write and/or execute inherit. – ctrl-alt-delor – 2017-02-24T18:45:55.373
@Ramhound Huh. I always understood it as a file transfer, not necessarily FTP but conforming to the look and feel of it, tunneled over SSH. Thanks for the correction. – Michael Cordingley – 2017-02-24T18:48:04.760
may depend on which sftp “sftp is an interactive file transfer program, similar to ftp(1), which performs all operations over an encrypted ssh(1) transport.” — sftp manual. However this is not what the question is about. – ctrl-alt-delor – 2017-02-24T18:48:42.873
If you set the permissions on the desination folder ahead of time, new and any modified files, will inherit those permissions. Your real problem is you have a single user account, which means I presume its being used to launch Apache, which means thats a security concern itself. Apache should be ran with a user that only has the permissions it needs to run Apache. What permission, of course, Apache will needs is project dependent. If you are creating files with a script be sure the script is ran, with a user, with only the permissions required. The script's files should inherit permissions – Ramhound – 2017-02-24T18:52:15.027
Will the files that Apache needs write access to every need to be manually updated via the ssh/sftp? Or are those files exclusively data? If it is exclusively data, then it should be pretty easy. – Zoredache – 2017-02-24T19:11:49.200
@Zoredache Exclusively data. If I ever go in for manual manipulation of them, it'd be a simple one-off. The SFTP upload would be syncing code and supporting files, not data. – Michael Cordingley – 2017-02-24T19:34:42.613