1

Good Day,

There is a linux user and group called "developers" (has no sudo access) with home folder in "/home/developers".

There is nginx running on the same server, there is a web folder for a site called "mysite.com". that web folder is in "/usr/local/nginx/html/mysite.com/" Folder site rights are "nginx:developers" and chmod permissions are 770. Now here comes the problem.

Users "scp" their files into the server using "developers" user. Files get stored in "/home/developers" folder WITH "developers" owner (obviously). Users have to copy those files into "/usr/local/nginx/html/mysite.com/" folder. After "developers" user copies files lets say "testfile.py" into "/usr/local/nginx/html/mysite.com/" owner of the file stays as "developers:developers". Therefore, nginx can not read the file.

How can I make that work? How can I allow user "developers" to transfer files into "/usr/local/nginx/html/mysite.com/" with nginx:nginx permissions? (without giving sudo access). Or what can I do on group level to make sure nginx will read those files?

Edit: nginx and php-fpm running as "nginx"

Thanks in advance.

1

what can I do on group level to make sure nginx will read those files?

It doesn't sound like there would be any particular issue with putting the nginx user into the developers group:

As root:

usermod -a -G developers nginx

A user can be in multiple groups. You can see which ones nginx is currently in with:

grep nginx /etc/group
# Or more simply:
id nginx

If putting nginx in developers poses some problem, you'll have to create a new group, put both the nginx and developers user in that, and make sure the transferred files have that GID.

Note that you must log in again before new group memberships become available. For non-login accounts (presumably nginx is one) you can just use su or start a process which does the same (in this case, the nginx server itself should work).

  • 1
    Instead of the grep you could also use getent group nginx and id nginx. – michas Nov 10 '14 at 18:20
  • @goldilocks what i will explain now will sound too moronic of me. I had tried what you have suggested before (friday). Developers had complained that nginx was giving forbidden error. Apparently, I had to restart nginx after editing user and group permissions. I just don't know what to say at this point. Speechless. I could never think of that one... Microsoft moment for a while... – fcukinyahoo Nov 10 '14 at 21:04
  • Whoops, yeah -- forgot to mention you need to log in again for changes like that to take affect. If it is a non-login account, try su nginx and then test permissions. You would then have to restart any processes running as that user (I've added a couple of sentences about this). – goldilocks Nov 10 '14 at 21:18
  • yeap nginx is a user without shell and home dir so since Friday I have been dealing with its permissions and forgetting to restart the service and flushing privileges (a huge facepalm)... – fcukinyahoo Nov 10 '14 at 21:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.