I'm not sure why, but people seem to be sold on the idea of using
www-data as the group for all websites on a server. I would like to separate all websites by different users. For example,
jaap.nl has user and group
jaap:jaap. The NGINX user
nginx is part of the
jaap group and has read access. PHP-FPM runs with
jaap:jaap and thus has read and write access.
This works well so far, but I'd like to be able to
rsync files to the server through my system-wide SSH account. Solutions:
- make my SSH account member of the
g+sfor all files for
jaap.nl, however now
scpwill create files with my SSH account username...but maybe that's not so bad after all
- SSH login using
jaapseems cleaner, but this will expose many accounts available for logging in on SSH and I will need to setup chroot for all of them
- other options?
Never used ACLs before but this was a good time to get to know them. I've got it to work as follows:
jaap:jaapowns all the files initially, where
nginxa is member of the
jaapgroup. The permissions are
750for directories and
640for files, so
nginxonly has read access. Since PHP-FPM pools run as user
jaapthey have write access.
- I've set ACLs as such:
u:piet:rwx,d:u:piet:rwx,m:rwxfor directories and
u:piet:rw,m:rwfor files. Here
pietis the SSH user that needs read+write access. New files and directories will add
pietto the ACL as well.
- By setting
g+son all directries we ensure the new group of files/directories will always be
jaap, so that
nginxhas read access and
jaaphimself can read the files. You could also fix this with ACLs.
Thanks @Michael Hampton