1

So, I got my Raspberry Pi 2 yesterday, installed nginx, php and vsftpd.
nginx was running, PHP files were processed and served, I could connect to FTP, so I thought everything is fine and left it there.

Today, I decided to start NetBeans and do some work, but ultimately run into problems with FTP.

I can

  • connect to FTP using the default pi user without any problem
  • create new files

I can't

  • manipulate existing files via FTP (created via bash or FTP under the pi user)
  • nginx/php can't access files created via FTP

vsftpd.log doesn't really provide any useful insight into this (550 operation failed).

nginx logs Unable to open primary script: /home/pi/www/index.php (Permission denied)", as if the user running the process had no rights to read the file (nginx is running under pi, though).

In my vsftpd.conf file, the only thing I changed is write_enable to YES, all the rest is default.

ROAL
  • 113
  • 1
  • 5
  • Welcome to the Raspberry Pi corner of the Stack Exchange. Is that ftp or sftp - how do you authenticate a remote login? It does sound like a permissions issue BTW. – SlySven Feb 03 '16 at 20:14
  • It's ftp, to authenticate I simply use the default pi user with my local password. – ROAL Feb 03 '16 at 20:19
  • The reason I asked was that some systems lock down/disable ftp because the login process sends the username and password unencrypted (same as telnet) whereas tunnelling it over ssh (I think that is what sftp is!) is regarded as safe. For anonymous ftp this is not an issue for downloading public files (no authentication, or anonymous as user name and email address as password) and may be OK for uploading NEW files to an "upload" area, but overwriting or other arbitrary operations on existing files will probably not work. Mind you it is years since I used ftp so I may have that wrong...! 8-) – SlySven Feb 03 '16 at 21:02
  • Does that php file need to be executable, not just readable? – goldilocks Feb 04 '16 at 02:38
  • Personally if net beans will allow it (long time since I used it) I would ignore FTP as its insecure and just use sftp, which runs over ssh. However, you do seem to have some permissions issues. Where are you trying to write to? What folder? What are the permissions and ownership of that folder. Some visual ls -la might help the diagnosis. – Byte Insight Feb 04 '16 at 07:32

1 Answers1

1

I assume you're working on /var/www and its subdirectories. If not, simply change /var/www to the correct directory (in you case, /home/pi/www/). I recommend you use the default /var/www and move your files over there.

Not sure how pi got write permissions there but here are some pointers:

  • When you create files using pi, it will be owned by pi.

    • nginx usually uses www-data user, so that's why it can't read it. It also can't modify it.

  • Likewise, when something is owned by www-data, depending on the permissions, pi cannot modify it. That's why you can't modify files.

There are multiple fixes for that, depending on your preferences. Here's how I do it:

  1. Add pi to the www-data group using the command sudo adduser pi www-data
  2. Add www-data to the pi group using the command sudo adduser www-data pi
  3. Change the permission of the directory and everything in it so that it's readable and writable by the group. Use the command sudo chmod -R 775 /var/www.
    • Since user pi is part of www-data group, doing this allows the pi to modify files.
    • Since user www-data is part of pi group, this allows nginx to read files created by pi.
    • Confusing? This is because users www-data and pi have their own groups also named www-data and pi.
  4. Make sure everything in the folder is owned by www-data.
    • sudo chgrp -R www-data /var/www
Aloha
  • 7,136
  • 1
  • 28
  • 52
  • Thank you, after adding the uses to the groups, it looks like everything is fine now. Is there any reason I should use the default /var/www instead of /home/pi/www. If I had multiple users, then using the home folder of one of them might not be the best, but I plan to work on it by myself and mostly use it for myself. Is there any other reason than convention? – ROAL Feb 06 '16 at 06:53
  • @ROAL Nothing too specific. It's just standard practice in my point of view. – Aloha Feb 06 '16 at 06:54
  • @ROAL If you're planning on having multiple users, what you're doing right now is the right way to do it. – Aloha Feb 06 '16 at 06:54
  • I meant it more like having multiple users working on the same project. In that case, /var/www would probably be better, with /home/username/www being their "personal" project. Though for now I'm far from anything like this. – ROAL Feb 06 '16 at 10:01
  • @ROAL Mmhmm. Just settle on what works for now. – Aloha Feb 06 '16 at 12:02