41

An error occurs when I try to make SSH connection:

$ ssh -p 22 www-data@x.x.x.x 
This account is currently not available
54

You're getting the This account is currently not available. error because the shell for the user www-data is set to /usr/sbin/nologin, and it's set for a very good reason. You should not log in as www-data, it's a special user/group used by the web server, not intended for regular shell use.

EDIT: It is an especially bad idea to give sudo rights to www-data. If Apache was intended to run with root permissions, it wouldn't have it's own group. By doing this, you are creating huge security holes. You have been warned.

  • 5
    That's not very constructive. What information do you think I should add to make this answer better? – kraxor Oct 13 '15 at 10:17
  • 4
    @kraxor is correct but if you must you can login as root and change /usr/sbin/nologin in /etc/passwd to /bin/bash and it'll grant that user shell access. I do this when just running a snap binary as my webserver. www-data is generally reserved for nginx/apache on ubuntu hence the no login status. – engineerDave Oct 13 '15 at 22:19
  • 4
    @RyanNerd It's your choice not to "give a rat's a$$ about security crap". Running everything as root is not recommended even inside Docker. You could of course configure Apache to run as root, or add a login shell to www-data, but that's like opening a bottle of wine by breaking the bottle because you're too lazy and careless to use a cork-screw. – kraxor Mar 23 '16 at 13:08
  • @kraxor your link to docker is out of date. EVERYTHING is still owned by root in Docker and it is still a problem. – RyanNerd Mar 24 '16 at 21:06
  • I have a similar case. I want to run LibreOffice in headless mode in a way that it can be called by a PHP script to convert documents and that it can write files to disk as www-data because these files later need to be deleted by www-data (part of a PHP script) to clean them up. This (launching an headless LibreOffice as user www-data) used to work in previous versions of Ubuntu, and I understand that this is a security improvement over these earlier versions. – ywarnier Jul 21 '16 at 23:05
48

While I agree with the others that allowing login through SSH through the www-data user is generally a bad idea, once you've logged in with a normal user it may be useful to run multiple commands concurrently with the permissions set of the www-data user. In that case, one can run

sudo su -l www-data -s /bin/bash

and you will be able to access your files as the www-data user.

  • 1
    Very useful for debugging permissions for a daemon/service user – jmng Feb 14 at 14:06
  • you just saved my day thanks! I had trouble getting perl-fcgi service started because the startup script was not using -s /bin/bash – Couitchy Jun 4 at 13:20
-1

The first question I would have to ask is, what are you trying to accomplish by doing this?

kraxor is 100% correct you should never be able to ssh into your server using your Apache/Nginx user. Doing so invites every hacker with half a brain cell into your server.

If you need to run a script or some program as that user you could try sudo -u www-data yourscript or you could temporally chown on the file to a user with login privileges. It's just a vary bad idea to allow this account that kind of access.

  • 5
    You should know that su - doesn't work for accounts with disable login. – sorin May 2 '16 at 13:32
  • What account is disabled? It says nothing about the account being disabled – TheStarvingGeek May 2 '16 at 13:38
  • 1
    Well having nologin in passwd means disabled login :) – sorin May 2 '16 at 23:44
  • 1
    It's a service account not a disabled account, you can run commands under it – TheStarvingGeek May 3 '16 at 11:54
  • My server doesn't appear to know that distinction @TheStarvingGeek – LovesTha Jun 7 '17 at 23:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.