Rsync to NFS directory via bastion with SSH as SSH user but write as www-data

user_688954 0
Viewed 47

I have this deployments architecture that deploy scalable WordPress using Amazon ECS containers. These are based from official WordPress image; The containers also mount an Amazon EFS file system on /var/www/html/wp-content mainly to host plugins and themes. The reason is because some plugins write files inside the wp-content directories, and I'd like the containers to have access to that files.

There is also bastion EC2 instance host so that I can access the EFS directory to make modifications and sync to locally.

enter image description here

The problem is I couldn't write the EFS directory without sudo-ing as www-data.

$ssh -i private_key.pem ubuntu@$BASTION_HOST

$touch /var/www/html/wp-content/test.txt
touch: cannot touch '/var/www/html/wp-content/test.txt': Permission denied

$sudo -u www-data bash # Access bash as www-data user

$touch /var/www/html/wp-content/test.txt
$ls -al /var/www/html/wp-content/test.txt
-rw-rw-r-- 1 www-data www-data 0 Aug 12 01:08 /var/www/html/wp-content/test.txt

What I want to achieve is that I want to do rsync the plugin in my local development both to and from the wp-content directory.

I tried the command below

rsync -av -e "ssh -i private_key.pem" content/plugins ubuntu@$BASTION_HOST/var/www/html/wp-content

but it failed.

I also tried as www-data, just for sure.

rsync -av -e "ssh -i private_key.pem" content/plugins www-data@$BASTION_HOST:/var/www/html/wp-content

I tried rsync to other directory, though, and it works.

rsync -av -e "ssh -i private_key.pem" content/plugins www-data@$BASTION_HOST:/home/ubuntu/sync

I wanted to change the permission of the /var/www/html/wp-content in the bastion to ubuntu, but the last time I did it, the WordPress containers couldn't write to the NFS directory; so the safest way is to keep the permission intact.

What did I miss?

Update 1

I tried adding ubuntu user into www-data in the bastion server.

$ sudo usermod -aG www-data ubuntu
$ cat /etc/group | grep www-data
www-data:x:33:ubuntu
$ touch /var/www/html/wp-content/test.txt
touch: cannot touch '/var/www/html/wp-content/test.txt': Permission denied

Still doesn't work.

wordpress ssh rsync bash
1 Answers

Great problem description. Clearly there's a permissions issue, so I'll suggest the first thing to look at and assume you don't already have that covered.

Is the default ubuntu user a member of the www-data group?

Being a member of that group could give the required privilege levels. To add the ubuntu user to the www-data group, allowing it/you to write to the mounted web directories while ssh'ed into the Bastion server:

sudo usermod -aG www-data ubuntu

To remove a user from a group:

sudo gpasswd -d ${USER} www-data

You'll have to test whether the ssh server on the bastion host will allow you to, say rsync files into the mounted web directories from your local development host. That might be a configuration issue in the bastions /etc/ssh/sshd_config file.. not sure, haven't tried, but one to look at next if necessary. Good luck.

user_152353920
Related