0

It took me a while to figure out how to install SFTP, and set up a user, sftpwp, that was restricted to it's own home directory and to using only those commands that are internal to SFTP. I created a symbolic link between /var/www in the home directory of user sftpwp.

This is on Ubuntu 12.04. (I don't run the more recent releases of Ubuntu because they don't seem to like the KVM I use to access this machine directly).

Alas, I get the following error when I try to update Wordpress.

Could not copy file.: wordpress/wp-admin/includes/update-core.php

I know SFTP is working, and observed Wordpress' panel saying it successfully downloaded an update file: but then it stopped at the above error.

I tried to get help on the Wordpress forum, but was told that because this is an administrative issue, it was off topic for the Wordpress fora.

So, what might be the problem: restricting the user sftpwp to only what is internal to sftp, or restricting it to it's home directory, or is it some other permissions issue? And, what would be the fix? Please remember, I am not an administrator, but rather a programmer.

Thanks,

Ted

8
  • Are you talking about FTPS or SFTP? SFTP is trivially easy to install on 12.04 - the openssh-server package includes it.
    – muru
    Jul 8, 2014 at 18:23
  • Sounds like it might be a permissions issue. Symlinking may not have sufficient rights to allow the copy. That said, WP has update/upgrade functions in its Admin CP - why not use those?
    – douggro
    Jul 8, 2014 at 18:26
  • Actually, I have both FTPS and SFTP installed and configured. I would agree that installing SFTP is trivially easy to install, ONCE you know it is included in openssh-server, Further, making a user that is constrained to use only SFTP commands, and that within it's own home directory is fairly easy. Understand, I have both FTPS and SFTP working flawlessly, when I connect directly to the server from elsewhere on my LAN. It is only determining the right permissions for the user that is dedicated to updating Wordpress using SFTP that is the problem. Jul 8, 2014 at 18:32
  • douggro, what I am trying to achieve is to configure my user sftpwp so that it can be used in that function in it's Admin CP. When using that, it asks for a user ID and password, and with the plugin I installed, SFTP is an option (and one I prefer because I am told it is the most secure). I do not know if the problem is due to my configuring sftpwp so that it has no shell access, or because it does not have write permission to /var/www, or something else I can't, yet, imagine. Jul 8, 2014 at 18:37
  • Hmm. Wordpress would be running as the www-data user (the one usually assigned to the web server). So changing the group on the sftp user's home directory to www-data and making it setgid might solve it. You might also have to give group write permissions at some directories.
    – muru
    Jul 8, 2014 at 18:37

1 Answer 1

0

I tried it out. I just noticed that the Wordpress directory as extracted from tar.gz file is owned by nobody:nogroup. Is that the case with you? If so, change it to sftpwp:www-data. Note that we're setting the group to www-data, but we could add the www-data user to the sftponly group as well and use www-data:sftponly as the owner. In either case, this is to allow write permission to the server, for media upload and such. So you'll at least need to do:

chmod g+w wordpress/wp-content

Further, we can apply setgid. When a directory is setgid, any file created within it inherits the group of that directory, irrespective of the active group of the user who created it. So this guarantees that any file add to the Wordpress folder retains the www-data (or sftponly, if you so choose) group. Do:

chmod g+s wordpress/wp-{content,includes}

I only included these two folders since uploaded content usually affects them. I noticed that uploaded media had www-data:www-data as the owner, so you might want to use sftponly as the group owner and then do setgid - then the sftp user can also access them.

12
  • Interesting, Muru. When I extracted Wordpress, owner and group was set to 'ted' (My user name). And, within /var/www, all the files and subdirectories have owner:group set to root:root (as does /var/www). I suppose that I ought to execute, as root, chown -R www-data:www-data * Jul 9, 2014 at 2:31
  • It is a tricky question. But at least wp-content folder should have write permission for the sftp user, otherwise uploading will fail. So you could do chown to www-data:www-data, and add sftp user to www-data (or vice-versa).
    – muru
    Jul 9, 2014 at 2:34
  • I have acted on the advice you have given above. That last thing I need, to try another test, is the command that makes sftpwp a member of www-data in addition to sftpony, and what command can I execute to show what groups a given user is a member of. And, a last question is, does any of this create a security vulnerability? Jul 9, 2014 at 2:48
  • @user1289485 to add a user to a group: sudo adduser <user> <group>. To see which groups a user belongs to: groups <user>. As for vulnerabilities, not that I can tell. I am unsure about making www-data the owner of the directory - I don't feel it is the right thing to do, but I think that is something I am not knowledgeable enough to advise you on. Best ask a second question, either here or on WP forums.
    – muru
    Jul 9, 2014 at 3:16
  • Or on Information Security.
    – muru
    Jul 9, 2014 at 3:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .