<p>According to the <a href="https://nginx.org/en/docs/ngx_core_module.html#user" rel="nofollow noreferrer">Nginx docs</a> you can configure the user which runs Nginx. By default the user is <code>nobody</code>.</p>

<p>You can read <a href="https://askubuntu.com/questions/97810/how-to-make-apache-run-as-current-user">this</a> Ask Ubuntu question that explains how to configure Apache2 to run as a different user. The default user running Apache2 is <code>www-data</code>.</p>

<p>A common strategy, and one I think may work for your goal, is to assign the users that need to deploy the application to a common group. For instance, if you added them to the <code>www-data</code> group:</p>

<pre><code>sudo adduser &lt;user&gt; www-data
</code></pre>

<p>You can see which groups is a member of with:</p>

<pre><code>groups &lt;user&gt;
</code></pre>

<p>Then change the group of the directory where users will run <code>migrate.php</code>:</p>

<pre><code>sudo chgrp -R www-data /var/www/demoapp
</code></pre>

<p>Then assign the group read/write/execute permissions to the directory:</p>

<pre><code>sudo chmod -R g+rwx /var/www/demoapp/
</code></pre>

<p>The users in this group should now be able to write and run scripts within the <code>demoapp/</code> directory.</p>

CC BY-SA 4.0
2019-06-20T05:13:43.977Z
When an application runs, it creates files with default mode and owner (`rw-r--r-- www-data:www-data`) and `<user>` can't write them during a migration. How to solve this? By running `sudo -user www-data chmod -R g+w /var/www/demoapp/storage`?
Finesse
CC BY-SA 4.0
2019-06-20T13:02:53.983Z
@Finesse could the application that is running, and can write files to the storage directory, be configured to change the permissions of the directory when it is finished? I guess I would need a little more information about what the applications is doing when executed by a user.
Argyle
CC BY-SA 4.0
2019-06-21T02:07:41.907Z
The application uses third party components so a developer can't fully control what application writes. For the sake of simplicity let's say that the application writes data file both when it's executed by the web server and a user.
Finesse
CC BY-SA 4.0
2019-06-20T03:43:37.010Z
2019-06-20T03:43:37.010Z
Argyle
<p>I usually stick to a <code>755</code> (or <code>rwxr-xr-x</code>) on my web root, but I do not think this is the issue you're running into since your directory is already set to that.  <code>nginx</code> should have access to your directory.  The question then becomes the permissions (or existence of) the file you're trying to access.  The files within your directory will need to be readable by the user <code>nginx</code> is running as.  I usually leave these files set to a <code>755</code> (the same as the directory).  You can change the entire directory by doing</p>

<pre><code>sudo chmod -R 755 /var/www/demoapp/
sudo chgrp -R www-data /var/www/demoapp
</code></pre>

<p>If there is not an index file in the directory, however, you will still get the same error.  The index file is used when you request a directory that doesn't have directory listings enabled.  The most common index file is <code>index.html</code>.  This default can be edited in your config, however, using something like:</p>

<pre><code>location / {
    index index.php;
}
</code></pre>

<p>If you want <code>nginx</code> to generate a list of files in that directory for you, simply turn on <a href="http://wiki.nginx.org/NginxHttpAutoindexModule" rel="nofollow noreferrer">directory indexing</a>, like so:</p>

<pre><code>location  /  {
  autoindex  on;
}
</code></pre>

CC BY-SA 4.0
2019-06-24T07:36:55.613Z
An application that doesn't write files is a pretty straightforward case. What about the files that the application writes (see the question for more details)?
Finesse
CC BY-SA 4.0
2019-06-21T05:36:04.230Z
2019-06-21T05:36:04.230Z
Subhash
<p>I have a server with Ubuntu with a web server (Apache or Nginx) running a PHP application. The application consists of the following parts:</p>

<ul>
<li>An executable code that handles HTTP requests (say in the <code>/var/www/demoapp/app</code> directory)</li>
<li>A configuration (say the <code>/var/www/demoapp/.env</code> file)</li>
<li>A file storage where the application puts its data (caches, uploads, etc; say in the <code>/var/www/demoapp/storage</code> directory). The application writes files behalf the web server user with 644 mode (let's say I can't make the application write with another mode).</li>
</ul>

<p>A deployment of the PHP application is made via SSH (the server is connected to) and consists of two stages:</p>

<ol>
<li>Upload the executable code to the server</li>
<li>Run migrations. The migrations must be able to write the configuration file and the file storage. Running migrations means executing a shell command (e.g. <code>cd /var/www/demoapp/app &amp;&amp; ./migrate.php</code>).</li>
</ol>

<p>What is the proper or the most common strategy of user/group accesses and file permissions for such application and deployment process? I expect an answer like «the web server should be run behalf user1, the SSH should be accessed via user2, the <code>/var/www/demoapp</code> directory should have the xxx mode and so on».</p>

<p>Due to security concerns, I don't want the SSH deployment user to be able to run commands behalf root. And I don't want the web application to be able to write the executable and the configuration files (except when there is a migration running). I admit these requirements may be omitted keeping a good security level.</p>

<deployment><linux><security><permissions><role-based-access-control>
What is the most common server permission policy for web application deployment?
Finesse
# What is the most common server permission policy for web application deployment?

(Asked by: username_0 on 2019-06-17)

I have a server with Ubuntu with a web server (Apache or Nginx) running a PHP application. The application consists of the following parts:

* An executable code that handles HTTP requests (say in the `/var/www/demoapp/app` directory)
* A configuration (say the `/var/www/demoapp/.env` file)
* A file storage where the application puts its data (caches, uploads, etc; say in the `/var/www/demoapp/storage` directory). The application writes files behalf the web server user with 644 mode (let's say I can't make the application write with another mode).

A deployment of the PHP application is made via SSH (the server is connected to) and consists of two stages:

1. Upload the executable code to the server
2. Run migrations. The migrations must be able to write the configuration file and the file storage. Running migrations means executing a shell command (e.g. `cd /var/www/demoapp/app && ./migrate.php`).

What is the proper or the most common strategy of user/group accesses and file permissions for such application and deployment process? I expect an answer like «the web server should be run behalf user1, the SSH should be accessed via user2, the `/var/www/demoapp` directory should have the xxx mode and so on».

Due to security concerns, I don't want the SSH deployment user to be able to run commands behalf root. And I don't want the web application to be able to write the executable and the configuration files (except when there is a migration running). I admit these requirements may be omitted keeping a good security level.

**Tags:** deployment, linux, security, permissions, role-based-access-control


---

## 2 answers

### Answer by username_1 on 2019-06-20. Score: 1

According to the Nginx docs you can configure the user which runs Nginx. By default the user is nobody.
You can read this Ask Ubuntu question that explains how to configure Apache2 to run as a different user. The default user running Apache2 is www-data.
A common strategy, and one I think may work for your goal, is to assign the users that need to deploy the application to a common group. For instance, if you added them to the www-data group:
sudo adduser  www-data

You can see which groups is a member of with:
groups 

Then change the group of the directory where users will run migrate.php:
sudo chgrp -R www-data /var/www/demoapp

Then assign the group read/write/execute permissions to the directory:
sudo chmod -R g+rwx /var/www/demoapp/

The users in this group should now be able to write and run scripts within the demoapp/ directory.

> **Comments:**
> **username_0**: When an application runs, it creates files with default mode and owner (`rw-r--r-- www-data:www-data`) and `<user>` can't write them during a migration. How to solve this? By running `sudo -user www-data chmod -R g+w /var/www/demoapp/storage`?  
> **username_1**: @username_0 could the application that is running, and can write files to the storage directory, be configured to change the permissions of the directory when it is finished? I guess I would need a little more information about what the applications is doing when executed by a user.  
> **username_0**: The application uses third party components so a developer can't fully control what application writes. For the sake of simplicity let's say that the application writes data file both when it's executed by the web server and a user.  

---

### Answer by username_2 on 2019-06-21. Score: 1

I usually stick to a 755 (or rwxr-xr-x) on my web root, but I do not think this is the issue you're running into since your directory is already set to that.  nginx should have access to your directory.  The question then becomes the permissions (or existence of) the file you're trying to access.  The files within your directory will need to be readable by the user nginx is running as.  I usually leave these files set to a 755 (the same as the directory).  You can change the entire directory by doing
sudo chmod -R 755 /var/www/demoapp/
sudo chgrp -R www-data /var/www/demoapp

If there is not an index file in the directory, however, you will still get the same error.  The index file is used when you request a directory that doesn't have directory listings enabled.  The most common index file is index.html.  This default can be edited in your config, however, using something like:
location / {
    index index.php;
}

If you want nginx to generate a list of files in that directory for you, simply turn on directory indexing, like so:
location  /  {
  autoindex  on;
}

> **Comments:**
> **username_0**: An application that doesn't write files is a pretty straightforward case. What about the files that the application writes (see the question for more details)?  

---

