I've got a vsftp server running. Here's what I want to do :
2 developpers are given the access through an ftp client to a web directory. They write the files they want. Then they refresh the pages (F5) and the web server gives them the new pages.
Here's what I did :
- Create a group (name it
allaccessgroup
). - create
user1
which belongs to this group anduser2
which also belongs to this group - create a directory
/var/www/newsite
chgrp allaccessgroup /var/www/newsite
chown apache /var/www/newsite
chmod 570 /var/www/newsite
This way : apache can read, and only read the php files and all user1 and user2 are given the rights to do what they want.
The problem is that I want user1 and user2 to upload their files. When they are uploaded the files permissions are allaccessgroup / user1 or allaccessgroup / user2, and I want the permissions allaccessgroup / apache.
I'm looking for a way to change the ownnership automatically as soon as the files are uploaded. I've read some stuff like this : create a php file then call once the upload is done :
$complete = $complete.exec("ssh root@host -i /path/to/pulic/key chmod 0700 /Users/".$shortname."/Private/\n");
I don't like calling "exec" this would mean grant the "exec" access to php... Any other idea welcome !
By the way :
I've been looking to the vsftp config file :
chown_uploads=YES chown_username=apache
but this is for for uploaded anonymous files to be owned by a different user, not for a specific user
Any other idea welcome !
Thanks !
Take a look at the local_umask directive inside the vsftpd.conf
Another option is to look at sticky bits if the two belongs to the same group, but it is not their primary group. chmod g+s /var/www/newsite This way, all new files created in the directory will have the group ownership of the parent. Haven't checked sub-directories though, but you can test that.
file_open_mode = The permissions with which uploaded files are created. Umasks are applied on top of this value. You may wish to change to 0777 if you want uploaded files to be executable.
This is slightly offtopic, but VSFTP ships with the anonymous user enabled, just so you know.
http://www.standalone-sysadmin.com/blog/2008/11/default-vsftpd-on-centos-is-dumb/
Just letting you know in case you didn't test that.