3

I have a website being served by Nginx and I've recently setup travis builds and deployments for it.

Nginx is running the website as www-data user. I've created an user deploy so that Travis can login on the server through SSH and deploy the website. Deployed files are being stored with deploy user as owner, which is different than the user that is running the website (www-data).

I'm afraid of having permissions problems running the website with this setup. Should I use the same user www-data/deploy to run and deploy the website? Using this approach, will I have problems by allowing the user running the website to login remotely through SSH?

Please enlighten me regarding this.

Alexis Wilke
  • 2,697
  • 2
  • 19
  • 42
Hugo Durães
  • 33
  • 3
  • If building up a multi-site VPS, I recommend mod-ruid2 + Apache. (Biba meu conterrâneo) http://unix.stackexchange.com/questions/262138/apache-cant-access-file-while-is-has-permission – Rui F Ribeiro Oct 28 '16 at 17:23

1 Answers1

5

Actually, the files should not be owned by www-data because that means Nginx can modify them, which in most cases is not what you want (unless it is a CMS that needs to self-update.)

So all the files should be owned by deploy.

If it is a CMS and you need to write in a few folders, then those very few (one?) folders should indeed be own by www-data. That can cause a problem if the deployment does the very first installation as well. Either offer the user to run a manual step, or have a special tool do that job, but if it is a one time thing, just do it manually, it's going to be easy enough (especially because you only have one folder like that, right?) The CMS can also tell you if there is such a problem and stop instead of serving pages. That way you know immediately and you can avoid having problems when you try to upload a file or some similar action.

Of course, files are not owned by www-data but they need to be readable by www-data. So either make it readable by others (-rw-r--r--) or look into setting the group to www-data (-rw-r-----). In most cases, I've seen people not even take the risk of using the group. They just let others access the files because it is safer that way.

Of course, it also means that Nginx would have no access rights to the deploy user and group.

Alexis Wilke
  • 2,697
  • 2
  • 19
  • 42
  • Does the same applies to the root folder of the website? Should it be owned by the deploy user? – Hugo Durães Oct 28 '16 at 17:15
  • @HugoDurães Yes because otherwise the deployment tool cannot add new files. – Alexis Wilke Oct 28 '16 at 17:20
  • 2
    +1 ditto, in 1 tier, I go for the same, but typically we'll have 2 or 3 tier envs, so apache / nginx owns nothing, but has group ro access to static content, in tier 2 where the application is, the application will have it's own user. – mikejonesey Oct 28 '16 at 18:16