I'd like to have my apache user be able to read and write files, my sftp user(s) to be able to upload files that are then available (rwX) to both other sftp users and apache, and everyone else read is ok.
psst: I know this question comes up a lot, and I've been reading answers and trying many many things for two days now and am now thoroughly confused
. Also I'm aware of the security risks involved in allowing www-data write access to my site, but that is not the issue I'm here to discuss.
Here's my steps:
usermod -aG www-data tim
mkdir -p /var/www/mysite/public_html
# now upload/untar the site, etc. not shown here #
chown -R www-data:www-data /var/www/mysite
chmod -R u+rwX,go+rwX,g+s,o-w /var/www/mysite
# now make the apache virtual host and so on .. not shown here #
Files inside public_html
are set like this - group has write:
-rw-rwSr-- 1 www-data www-data favicon.ico
Now, logon on as my "tim" account using sftp, I upload a new file to the public_html folder, then look at its permission:
-rw-r--r-- 1 tim wwww-data COPYING.txt
So I've lost group WRITE, even though I thought I'd added g+s
on the parent folder so that it would inherit the group.
Apparently this doesn't mean that it also inherits the group /mask/. I've read somewhere (and lost reference) that SFTP doesn't honour the umask; that seems to be where the permission are getting lost, but I don't know how to fix it.
edit found the umask reference and have tried it - http://john.parnefjord.se/node/62 - can see that the file is executing apon login, but still the mask isn't set to g+w after an upload.
g+s
only affects the group ID assigned to new files, not the group permissions.