Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question has been asked many times, but I haven't found a solution for this type of permission.

I have a VPS with multiple websites in chroot, each one running with a unique user, without root privileges. I'm trying to implement a deployment script, which is run by a master user (not root either), who can access all websites, and modify all files.

A common group

The first advice I normally see, is to create a group, which contains both the master, and all the website users.

As I understand it, I will have to change the permissions of my files and folders to 770 (or something similar that gives group equal permissions as the owner). However, I often experience these permissions being "reset" to 700 (or similar, where group loses the permissions). Most of my sites are built on Wordpress, which might have some automagic security stuff, that resets overblown permissions. Also, if a developer locally changes the group permissions, and uploads these, the permissions will be changed.

I'm looking for a more stable solution - any clues?

Cheers :)

share|improve this question
Use ACLs if your file system supports that. – mailq Dec 5 '11 at 23:55
Yes, all those how-tos out there don't seem to have ever heard of POSIX ACLs which are the way to go forward for all those problems once and 4 all. – pfo Dec 5 '11 at 23:57
Yup, it is supported by my system (Ubuntu). I'll look into it, thanks! :)… – sqren Dec 6 '11 at 0:00
At first glance, Posix ACL seems to be the answer of my prayers. Although: this also affects the group permissions, and if I change the permissions back to 700, it no longer works. eg. setfacl -m u:www-data:rx sharedfile.txt The sharedfile.txt will now have 750 in permissions, and if I change this back to 700, www-data can no longer access it. – sqren Dec 6 '11 at 1:12
up vote 1 down vote accepted

If the webserver doesn't have permission to change files.dirs then it can't change the ownership.

Although there's not really enough information here to design a security model, in general I find that basing the webserver uid access around the 'other' permissions is often the best approach - hence directories should be drwxrwSr-x (owned by a group which includes users requiring modify access but excluding the webserver uid, note use of setgid bit) and files -rw-rw-r-- (and if you need to have files editable by the webserver uid then drwxrwxrwx).

But this is not necessarily the best / complete model for your case - when you say the website are in chroot, do you mean that they are all in the same chroot? Or you've got multiple webserver instances each running in their own chroot? In the second scenario, splitting the user ids is redundant, and the model I described above is appropriate.

Certainly you don't want to allow the webserver uid permission to write any files within the document root except those specifically designated for that purpose.

So it sounds like maybe you should have all the files/dirs owned by your deployment user and with a group ownership of group with just 2 members - the deployment user and the webserver uid - and create your dirs / files as drwxr-S--- / -rw--r----- (again with designated upload dirs/files as drwxrwS--- / -rw--rw----)

share|improve this answer

Why don't you use a deploy tool like capistrano to write a task that connects on all servers with variable users and upload stuff using scp or sftp or even checks out from a git repository?

You can do something close using shell script and SSH, but deployment tools exist to solve those kinds of problems.

share|improve this answer
I've had at look at Capistrano actually, but it seems too much. All I want is to remotely run "git pull repo master". I works alright, except for the permissions. However, ACL seemed to solve it. – sqren Dec 6 '11 at 1:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.