Files uploaded as root to the web server can't be overwritten by web application

Question

Here is my problem. I am developing a web application in PHP/MySQL and I am having some problems setting up the accounts I need to use.

Development workstation: WinXP SP3, Eclipse PDT

Development server: Debian 6.0, Apache2, MySQL 5, XDebug

Connected through a LAN.

While I am developing I upload code that needs to be tested to the server. I use GIT and ssh:root@myserver.

As expected, the files end up being owned by root in the server.

My web application needs to update some of the files. To allow that I ran chmod in the server to change ownership of the files to www-data. This works fine.

The problem is that every time I change a file and upload it again it reverts back to root ownership and I have to manually change it back to www-data.

I don't think this will be a problem in the production environment because I can ensure the files will have the correct ownership when they go live. However it is a pain the development process.

What I am thinking:

1 - I probably should not be uploading with a root account. I tried connecting to the server through ssh using the user www-data. However it asks for a password and after some reading I found out that it is probably not a good idea to mess with www-data user.

2 - I could probably create another account for development purposes and upload the files with that account. The problem is that I don't know how to configure my web application to use that account when connecting to the server and database.

3 - I could probably configure my application and database to run as root in the development environment. This would resolve the problem. However as stated in 2 above, I don't know how to do it and I something tells me that this would not be a good idea.

So I am looking for advice on how to solve my problem. I could go with any one of the three alternatives above (or even a 4th one that I haven't considered). Thanks.

Update - 2011-09-13

One solution from the responses below (thank you cdp1337) is to run a script to update the file permissions when I upload files to the development server. In my case, I could run

chown -R www-data:www-data *

in the root of my website. NOTE: this is NOT in the production environment and the development web server cannot be accessed outside our company. This is not a solution to deploy to production environment.

Any other ideas? Thanks.

Answer 1

1/2 - Yeah, would be good to upload the data as a non-privileged user, but I find myself doing the same thing when lazy.

3 - is IMO never a good idea, you never want to run an applications as root if you don't explicitly need to.

Otherwise to answer your question, I would suggest creating a build script that you can run which will do the necessary processes to configure your application. Many people use ant to do this, but a simple bash script with a few 'chown' directives in it should suffice for your needs here. That way when you upload the data, you just run the one script and you know it's built correctly.

Alternatively to the alternate, you can have an update script automatically pull in the newest version of your application from git and run the permissions. That would condense two steps into one.

Answer 2

Not only should you not be uploading files as root, it should not be possible to upload files as root. Are you responsible for the admin on this system?

I tried connecting to the server through ssh using the user www-data. However it asks for a password

I hope you're not responsible for admin. Go speak to whoever does look after the servers and try to work out a sensible security model. You've got a lot to learn about how all this stuff works - way beyond what could be provided as an answer here.

But you probably want to create a group including both a normal user account (which you will use for uploading files) and the http server user - note this should not be the default group for either user. Then for any directories where the apache uid should have write access (and it should be a very short list, outside the document root) change the group to the common group makes the contents readable by the common group and set the group sticky bit on the directories within these.

For the files/directories which you upload and should be readable by the webserver uid, enable read access (and execute access for directories) via the 'other' permissions.

If you really are responisble for admin on this box, then you need to take some time to start learning what your responsibilities are. There are lots of good books - rute is a good start.