83

An error occurs when I try to make SSH connection:

$ ssh -p 22 www-data@x.x.x.x 
This account is currently not available
Improve this question
1

3 Answers 3

Reset to default
137

While I agree with the others that allowing login through SSH through the www-data user is generally a bad idea, once you've logged in with a normal user it may be useful to run multiple commands concurrently with the permissions set of the www-data user. In that case, one can run

sudo su -l www-data -s /bin/bash

and you will be able to access your files as the www-data user.

Improve this answer
4
  • 7
    Very useful for debugging permissions for a daemon/service user
    – jmng
    Feb 14, 2019 at 14:06
  • 1
    you just saved my day thanks! I had trouble getting perl-fcgi service started because the startup script was not using -s /bin/bash
    – Couitchy
    Jun 4, 2019 at 13:20
  • maybe it has a siple way to make git pull without su - www-data? and generate rsa key for www-data user
    – Vasilii Suricov
    Nov 24, 2019 at 19:55
  • 1
    Very useful to check the crontab of the www-data, who can contain code inserted by bots if your website is not totally secure (in my case Laravel debug mode vulnerability).
    – user1097111
    Jun 25, 2021 at 16:17
88

You're getting the This account is currently not available. error because the shell for the user www-data is set to /usr/sbin/nologin, and it's set for a very good reason. You should not log in as www-data, it's a special user/group used by the web server, not intended for regular shell use.

EDIT: It is an especially bad idea to give sudo rights to www-data. If Apache was intended to run with root permissions, it wouldn't have it's own group. By doing this, you are creating huge security holes. You have been warned.

Improve this answer
8
  • 7
    That's not very constructive. What information do you think I should add to make this answer better?
    – kraxor
    Oct 13, 2015 at 10:17
  • 5
    @kraxor is correct but if you must you can login as root and change /usr/sbin/nologin in /etc/passwd to /bin/bash and it'll grant that user shell access. I do this when just running a snap binary as my webserver. www-data is generally reserved for nginx/apache on ubuntu hence the no login status.
    – engineerDave
    Oct 13, 2015 at 22:19
  • 4
    @RyanNerd It's your choice not to "give a rat's a$$ about security crap". Running everything as root is not recommended even inside Docker. You could of course configure Apache to run as root, or add a login shell to www-data, but that's like opening a bottle of wine by breaking the bottle because you're too lazy and careless to use a cork-screw.
    – kraxor
    Mar 23, 2016 at 13:08
  • @kraxor your link to docker is out of date. EVERYTHING is still owned by root in Docker and it is still a problem.
    – RyanNerd
    Mar 24, 2016 at 21:06
  • I have a similar case. I want to run LibreOffice in headless mode in a way that it can be called by a PHP script to convert documents and that it can write files to disk as www-data because these files later need to be deleted by www-data (part of a PHP script) to clean them up. This (launching an headless LibreOffice as user www-data) used to work in previous versions of Ubuntu, and I understand that this is a security improvement over these earlier versions.
    – ywarnier
    Jul 21, 2016 at 23:05
-2

The first question I would have to ask is, what are you trying to accomplish by doing this?

kraxor is 100% correct you should never be able to ssh into your server using your Apache/Nginx user. Doing so invites every hacker with half a brain cell into your server.

If you need to run a script or some program as that user you could try sudo -u www-data yourscript or you could temporally chown on the file to a user with login privileges. It's just a vary bad idea to allow this account that kind of access.

Improve this answer
6
  • 13
    You should know that su - doesn't work for accounts with disable login.
    – sorin
    May 2, 2016 at 13:32
  • What account is disabled? It says nothing about the account being disabled
    – TheStarvingGeek
    May 2, 2016 at 13:38
  • 2
    Well having nologin in passwd means disabled login :)
    – sorin
    May 2, 2016 at 23:44
  • 1
    It's a service account not a disabled account, you can run commands under it
    – TheStarvingGeek
    May 3, 2016 at 11:54
  • 1
    And it still doesn't. Always fun to find your own comment when looking for an answer years later.
    – LovesTha
    Dec 26, 2021 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.