So my nginx is using www-data:www-data, and I want to deploy files to my server with Beanstalk through sftp properly.

So I've created an user called beanstalk and added him to www-data group.

$ id beanstalk
uid=1000(beanstalk) gid=1000(beanstalk) groups=1000(beanstalk),33(www-data)

$ groups beanstalk
beanstalk : beanstalk www-data

Now that I've run a script that generates subby.site.net and sets it's permissions to be 755 www-data:www-data ( EasyEngine ), I'm ready to deploy my thing, but here is the thing:

beanstalk@site.net:/var/www/subby.site.net.net$ ls -la
total 20
drwxr-sr-x  4 www-data www-data 4096 Nov 14 08:50 .
drwxrwsr-x 26 www-data www-data 4096 Nov 14 09:32 ..
drwxr-sr-x  5 www-data www-data 4096 Nov 14 08:50 htdocs
drwxr-sr-x  2 www-data www-data 4096 Nov 14 08:50 logs
-rw-r--r--  1 www-data www-data 3052 Nov 14 08:50 wp-config.php

beanstalk@site.net:/var/www/subby.site.net.net$ mkdir test
mkdir: cannot create directory ‘test’: Permission denied

If I do sudo chmod 775 /var/www/subby.site.net, I can create that test directory with beanstalk user, but I don't think 775 is the correct way of setting web-server permissions, or am I wrong ?

  • Hi. Looks like a job for ACLs. At the moment the group can't write in this directory. Only the owner. – Eamonn Travers Nov 14 '14 at 9:43
  • Hi Eamonn, What should I look for in ACL ? I assume it's Access Control Lists - can you point me some good reading material about it that would be related to my scenario ? – justnorris Nov 14 '14 at 9:46
  • 1
    apropos ACL you want man setfacl and man getfacl. There are other ways of managing a public web site without mangling permissions, for example A git based web workflow – dawud Nov 14 '14 at 9:51
  • check this out serverfault.com/questions/515702/… – Hrvoje Špoljar Nov 14 '14 at 9:53

Your problem is that your beanstalk thing runs with beanstalk:www-data user/group when trying to access your www-data:www-data owned directory tree (the beanstalk group is useless here).

Since the user beanstalk has not rights there (the files/directories are owned by the www-data user, the permissions are decided at the group level (the files/directories belong to the www-data group which beanstalk belongs to). The 'other' permissions might be used too.

However, when you use 755 permissions on a directory, the 'group' and 'other' permission are 5, which means r-x. Thus your beanstalk program is able to open (execute) the directory and read its contents... but cannot create files there!

The problem I see with the ACL solution you have been provided with is that those ACLs need to be refreshed everytime new files/directories are created.

What you could do, using properties of the ext filesystem itself, is either:

  • Make your tree owned by beanstalk:www-data with default rights: the user is by default the only one allowed to write (755 for directories and 644 for files). SInce you just need beanstalk to do that, that is fine! nginx and any Web server program usually only need to read files and navigate through the directory tree, so making them part of the www-data is enough. To ensure subsequent directories creation have the www-data group automatically, you could set the setgid flag on your existing directories, already set with the beanstalk:www-data owner pair. Every new file/directory created will now be owned by beanstalk:www-data!
  • Add the write permission for the group to every created directories. However, once again, the default mask will create directories with 755 you will need to transform manually to 775... If your Web bcontent directory tree is on a dedicated partition, you could change the default permissions mask so it is 775, which is a limitation. Another downside is that now every application belonging to the www-data group will be able to write data i nthe directory tree... that includes nginx, and potentially any backend application. I find it bad to allow them 'open-bar' permissions: think of when they will get injected somehow, they could deface/erase everything at will!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.