Usually I setup my Ubuntu server to have at least 2 users:
- A user behalf which the web server (Apache or Nginx) runs, e.g.
- A user that updates and maintains the web applications, e.g.
A web application consists of 2 directories:
- A directory for executable files (e.g. PHP or JS) served by the web server (Apache or Nginx) and a code interpreter, e.g.
- A directory for the application to write (caches, logs, uploads, etc.), e.g.
I setup the directories with the following permissions:
├ app rwxrwxr-x deployer:deployer │ └ index.php rwxrwxr-x deployer:deployer └ storage rwxrwxr-x www-data:www-data ├ logs rwxrwxr-x www-data:www-data └ cache rwxrwxr-x www-data:www-data
The problem is that it's inconvenient to maintain the web application because it writes the files to
storage with the default permission and therefore
deployer can't write them. And vise versa,
deployer can leave files in
storage that are not writable by the application. An example of what happens after a while:
├ app rwxrwxr-x deployer:deployer │ └ index.php rwxrwxr-x deployer:deployer └ storage rwxrwxr-x www-data:www-data ├ logs rwxrwxr-x www-data:www-data │ └ applogs.log rw-r--r-- www-data:www-data # Deployer can't write └ cache rwxrwxr-x www-data:www-data └ somecache.json rw-r--r-- deployer:deployer # Application can't write
I can't make the application write files with other group or mode. I have to make some complex sudo setup and watch carefully the files created by
deployer to maintain the application and keep it running.
Does the application self-write restriction worth the inconveniences? Is it ok (considering security concerns) to run the web server and maintain the application using a single user that can write the files both in the