How should I rsync files in /var/www if I want them to be owned by www-data?

Question

I have set up a new ec2 ubuntu box and installed apache and php5. By default you log onto the box with the ubuntu user who has sudo privileges.

I believe apache runs as root and php5 runs as www-data.

I think that I want all of the files in /var/www to be chown'ed to www-data:www-data, and folders set as 755 and files as 644 - unless there is an issue with that.

Things run fine like this, but my issue is that when I rsync files from my laptop to the server it changes the ownership on them (and adds new files) as ubuntu:admin

I have been through the rsync manual and searched Google, and I've seen a syntax like:

rsync -avzcO (source) (destination) --owner=www-data --group=www-data

However it appears that --owner and --group don't not take an argument but instead are meant to be used to force the remote files to have the same owner as on the local file system if rsync is being done as a super user.

So, I haven't found a solution with rsync to set the remote user and group of files during rsync.

What am I doing wrong?

Thoughts:

• Maybe my files in /var/www should just be owned by ubuntu:admin ?
• Maybe I have the rsync syntax wrong
• I guess I could rsync as the www-data user but that doesn't seem like a good idea
• I could use suPHP like I would do on a shared host, but that seems like quite a bit of trouble

Answer 1

You don't want them owned by www-data. Apache initially runs as root and then drops privileges to www-data. You don't want your web content writable by the user that owns the apache processes. This creates a security vulnerability.

In the event that Apache is breeched, ideally the www-data user will have no access to any of the system. This is the most secure configuration. If the web content is owned by www-data, if Apache is breeched then the attacker can overwrite any of your web content.

Your web content should be owned by a normal user (this excludes nobody, www-data and root). Only things that need to be writable by Apache should be owned by www-data.