I'm not sure why, but people seem to be sold on the idea of using www-data as the group for all websites on a server. I would like to separate all websites by different users. For example, jaap.nl has user and group jaap:jaap. The NGINX user nginx is part of the jaap group and has read access. PHP-FPM runs with jaap:jaap and thus has read and write access.

This works well so far, but I'd like to be able to scp or rsync files to the server through my system-wide SSH account. Solutions:

  • make my SSH account member of the jaap group, set g+w and g+s for all files for jaap.nl, however now scp will create files with my SSH account username...but maybe that's not so bad after all
  • SSH login using jaap seems cleaner, but this will expose many accounts available for logging in on SSH and I will need to setup chroot for all of them
  • other options?


Never used ACLs before but this was a good time to get to know them. I've got it to work as follows:

  • jaap:jaap owns all the files initially, where nginx a is member of the jaap group. The permissions are 750 for directories and 640 for files, so nginx only has read access. Since PHP-FPM pools run as user jaap they have write access.
  • I've set ACLs as such: u:piet:rwx,d:u:piet:rwx,m:rwx for directories and u:piet:rw,m:rw for files. Here piet is the SSH user that needs read+write access. New files and directories will add piet to the ACL as well.
  • By setting g+s on all directries we ensure the new group of files/directories will always be jaap, so that nginx has read access and jaap himself can read the files. You could also fix this with ACLs.

Thanks @Michael Hampton


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.