Advice on Setting up Proper Permissions on Ubuntu 10.04 Server

Question

I run a server powered Ubuntu 10.04 LTS. the software stack that I use comprises of

• PHP fpm-fcgi Version 5.3.6
• Web Server: nginx/0.8.54

To make, things like wordpress work properly. I have done chown www-data:www-data on my public_html folder. This was all files are easily modifiable by nginx and things like Auto Updating wordpress work as expected.

The problem arises when I login via ftp and try to upload new files or change existing ones. Since, I use username as Gaurish & all files are owned www-data my requests are denied.

Response:   220 (vsFTPd 2.2.2)
Command:    USER gaurish
Response:   331 Please specify the password.
Command:    PASS ************
Response:   230 Login successful.
Command:    OPTS UTF8 ON
Response:   200 Always in UTF8 mode.
Status: Connected
Status: Starting upload of /tmp/cachegrind.out.5513
Command:    CWD /home/gaurish
Response:   250 Directory successfully changed.
Command:    PWD
Response:   257 "/home/gaurish"
Command:    TYPE I
Response:   200 Switching to Binary mode.
Command:    PORT 192,168,1,6,214,6
Response:   200 PORT command successful. Consider using PASV.
Command:    STOR cachegrind.out.5513
Response:   553 Could not create file.
Error:  Critical error
Status: Disconnected from server

I need a way by which I(gaurish) & nginx(www-data) can both modify the files. Any idea how to do that?

Answer 1

Shared group is one way as others have previously answered.

A more complex alternative would be to use a source revision control system like CVS, Subversion, GIT, etc.. Then a single admin cgi page,running as the webserver, can update all modified files on the server. This also ensures that you have a backup of the previous file before you overwrite it, given that source control is enforced.

Whatever you do, learn and use SSH and SCP not FTP. FTP should be used for the convenience of your users if absolutely needed, not for system administration.

Answer 2

You need to do a few things to get a complete solution:

• Add your user to the www-data group (as per @fbh's answer).
• Configure the FTP server umask to 007 so that files are uploaded with group write privileges.
• Set the setgid flag (g+s) on your directories such that new files are group-owned by the directory's group, rather than the file creator's primary group.

Answer 3

Add your user to the webservers group

usermod -a -G www-data gaurish