Ubuntu and web server permissions

Question

I am going to ask a question that has already been posted many times but even though I have read many guides and posts, I still have doubts.

I have a server with ubuntu 14.04 on which I have a user with sudo permissions (secondary group "sudo") and a user who just want to use for the "web server".

I will explain in detail...

• My webserver user is "jack" and this is part of the group www-data (as the primary group)

• The virtual hosts point to the jack's home directory where I created a subfolder called "alias" which contains subfolders with the various sub-domains

es.

/home/jack/public_html <-- main site
/home/jack/alias/forum <-- subdomain
/home/jack/alias/wiki  <-- subdomain
/home/jack/alias/cloud <-- subdomain

What I would like to know is:

• first question-

Is correct that jack belongs to the primary group www-data instead of belonging to the group users, and as a secondary group www-data ?

• second question-

A friend advised me to set the permissions on the web server folder in this way

chgrp www-data /home/jack/public_html
chmod g+rwxs /home/jack/public_html

And the same for the alias folders. Now it seems to work but there is a problem....

• If I load a file in the web server root permits are

jack:www-data 0644

• If the files are generated by www-data (for example through a cms)

www-data:www-data 0666

Now, if I edit a file manually, for example via ftp, this changes the permissions and creates problems to the various "web app"

How can I do to fix it?

Answer 1

First question: Whatever. There's a lot of different ways to make this work. The Linux standard does things differently than you're doing, but your way works also. The fact that you're not running the web server under the apache account like the Linux standard suggests does at least suggest there might be some other issues, but there aren't any indicated by the point of the end of the first question.

Second question: as the_velour_fog suggested, you need to set permissions for all of the web files, though I disagree with the method of doing so.

chgrp -R www-data /home/jack/public_html

is fine, and won't cause any problems. But instead of just adding the -R to the other command, I'd suggest

chmod -R g+rwXs,o-w /home/jack/public_html

Using this variant, it won't set execute permission on files that aren't already marked as executable. It'll also remove other write permission from all of the files, because it's unlikely that you really want that.

Of course, that chmod is only a band-aid to your issue with the web server creating files with permissions 0666. I'm not sure where exactly your web server's problem is, but I suspect at some point your web server user executes something like umask 0 and this should be changed to umask 02.

As far as the files you ftp having the wrong permissions, I'm not sure if that's a problem in the ftp server or if it's a problem with how the files are created before they're transferred. The files should also be created on sessions where umask 02 has been set, but they may be getting created with umask 022 in effect. (That could also be umask 22; technically the leading 0 is just there to remind the reader that the number is in octal. Umask will parse it as octal no matter what, but it's easy to forget that.)

If your permissions problems are relating to your ftp server... rather than fixing those, I'd recommend switching to scp or sftp, as ftp is a highly insecure protocol. In 2019, it's primary value is that it allows transfers to be made anonymously, but you can pull files anonymously with web servers, and you probably don't want anonymous pulls or pushes to your web server account. Both scp and sftp should be available on your Ubuntu server, so long as you have ssh installed and you have the sshd process running.