On a isolated local test/dev server I have elevated the nature of the www-data user to enable a smooth workflow for using Dropbox in a web/webapp development pipeline.
It has worked quite smoothly in my initial testing, and while I don't plan to move it to a production environment - I'm curious if it would send up any major red flags to the security pros if it were moved onto a production server.
Immediately upon installing Ubuntu 12.04 I deleted and recreated the www-data user with:
sudo deluser –remove-home www-data sudo adduser --system --disabled-login --disabled-password --group www-data
This provides me the /home/www-data environment in which Dropbox can be installed and operated with the permissions exactly how Apache/Nginx/PHP/etc expect them to work.
To elaborate, Dropbox operates in the user space with the following configuration:
/home/[USER]/.dropbox-dist - is where the libraries/executables are housed /home/[USER]/.dropbox - is where it caches data and keeps config data /home/[USER]/Dropbox - is where it keeps the synchronized data
It's odd, but it is what it is. Working in this configuration means that all synced data receives the permissions of the user that runs it. Rather than have to putz around with changing permissions manually or pseudo-automatically at the server every time files on the workstation are updated, I've opted to have www-data just run the daemon itself.
Aside from the obvious concerns of running a proprietary application with network access and a less than conventional operating mentality... does upgrading the www-data user to one with a somewhat higher presence on the machine open up security issues I have not foreseen?