How to properly setup user/groups/permissions for a web server?

Question

I spent all day figuring this out, but without success, so hopefully I can get some help here: I have Ubuntu 13.10 VPS server with nginx, PHP 5 and MariaDB installed.

I created custom system user (for example "myuser") which I use for connecting through SFTP to my server. In my user home directory I created "public_html" dir for my web root.

What I am trying to accomplish is that if I copy my files through SFTP (or rsync as well) they will be working not only with my user, but also with the PHP/server.

For example if I install WP it has no permissions to write in files as I am the owner of them. (therefore cannot upload files, install themes, plugins etc.) However this is not a WP problem, but overall user/group/permission setup problem

I was playing around with directory sgid, umask, assigning myself to www-data etc. but cannot find the right way to do this. (without manually chmod my files) For example on my ex-shared hosting I just uploaded a file where I am the owner and there is no problem with permissions. Running nginx/php under my user I consider as not secure.

Please help me with this issue - I need a stable and secure option.

P.S. I know I can chmod my files after I upload/create them, but this is not a solution as it is very time consuming/overhelming. I need to automate this process and I believe there is a proper solution.

Answer 1

Making sure I understand your question correctly ...

You are uploading files to your server as user myuser into /home/myuser/public_html/, and they are appearing with permissions -rw-------. Then your webserver (running as www-data) cannot access those files because it does not have permission?

One approach is to set the umask for myuser to something more permissive, such as 0022. (You can add this in your .bashrc with the simple line umask 0022.) This will make all new files and directories created by myuser available for read and execute by all users on the system, including www-data. (Of course, that might be too permissive for you, in which case you'll have to come up with something more involved.)

Now, a Google search for "sftp umask" will point out that this suggestion will not always work straight out of the box. It depends on how the FTP daemon is configured on your machine and how you're connecting to it. For example, it could be that your SFTP connections will not read your .bashrc file, so you'll have to find another way of getting the umask to apply to your connections -- or use another file transfer method, such as scp.