SSHFS is a FUSE filesystem. These are managed by a user-land process which runs as the user who mounts the filesystem: that
sshfs process you run doubles as the filesystem driver. By default, most FUSE filesystems only allow the mounting user to access files inside.
In order to be able to access files through sshfs, you need three things:
- The user who is authenticated over ssh on server1 must be able to access the files.
- The user who tries to access the sshfs filesystem on server2 must have the necessary access permissions.
- The user who tries to access the sshfs filesystem on server2 must be allowed to access that filesystem.
As I wrote above, only the mounting user has that last permission. You can relax this by adding
-o allow_user to the
sshfs command line, but this won't solve the other two problems. Note that
-o allow_user only takes effect if
user_allow_user or you are running
sshfs as root.
server2, you need to either run
sshfs as the
www-data user (whom you will have to give access to the SSH private key), or enable
allow_user and arrange for the local
www-data to have access to the files it needs. There are several ways to do that: through the
uid option, or by passing
-o default_permissions, or by passing
-o umask 770,gid=www-data. If you enable
allow_user, make sure that you don't end up allowing
www-data to access more files than it should, and that you don't end up allowing other users to see or modify what they shouldn't. Running
www-data has the advantage of simplicity, you have a far better chance of not accidentally being too permissive.
For problem #1, you need to ssh into the
www-data account on
server1, or to allow the account that you use to access those files. There is some benefit in not allowing remote logins to system accounts such as
www-data, because these make for poor auditing (you can't know who actually used the account). However, it's not out of the question, and it is somewhat easier to set up. If you don't want to allow remote logins to the
www-data account, add
salamis¹ to the
www-data group, make sure that the filesystem on
server1 is mounted with the
acl option (add it to the relevant entry in
/etc/fstab if necessary), and add an ACL to
setfacl -d -m group:www-data:rwx -R /path/to/www-root
setfacl -m group:www-data:rwx -R /path/to/www-root
¹ If that's your account on
server1, I didn't understand from your question whether
salamis was a user on
server2 or both.