How to properly setup web server directory permissions

Question

I'm lost with this, hopefully I can find some help here:

I have Ubuntu 12.04 LTS webserver.

For example I have user "myuser". There is a public directory which is my web root. I chowned it and all files in it as www-data:www-data. This enabled me proper work of PHP which can create/write files as PHP and web server run under www-data.

/home/myuser/public/

My problem is that when I transfer files with rsync through ssh my permissions, user and group for the files are changed. This mean after every transfer I have to do my chown again.

rsync -azv . -e ssh [email protected]/public/

I'm not sure if chown-ing the files is the "right" way, but I followed this tutorial at DigitalOcean: How To Install Wordpress with nginx on Ubuntu 12.04 and they do the following:

sudo chown www-data:www-data * -R 
sudo usermod -a -G www-data username

As well as in other tutorials.

I need some way when I will be not need to chown/chmod or whatever my files after each transfer (same as it works on shared hostings)

Any ideas how to achieve that?

Answer 1

Chown'ing the files is a way, and it's not wrong. The question is whether it's the right way for you in this particular instance, which is another question altogether...

Here are some other ways to do it:

• If you run the rsync daemon as root on the server, you can use the -o | --owner option to retain the same owner as on your local system. That of course means that the files need to be owned by www-data on the system where you edit them, too. On some systems this may be possible even if the rsync daemon isn't being run as root; you can try it by adding --super to the options.

• You can make the directory "setgid". That means that all files created within the directory will have the same group ownership as the directory itself, instead of having your primary group as the group owner. You do this by running this command: chmod g+s /home/myuser/public

• You can do the transfer as the user "www-data" instead of as yourself: This requires that www-data be allowed to login, which increases the risk of the system being compromised. If you do choose this despite the risk, I'd recommend that logins only be allowed with public key rather than with a password.

• Instead of doing rsync, set up a version control system, e.g. git. When you edit the file, check it in to the git repository. Then, instead of rsync'ing over the files, log in to your server, sudo to www-data and pull down the files from the repository.