I have a new Ubuntu NGINX hosting server for WordPress on which I am using (for the first time) site isolation for added security. Previously I've used WordOps which of course runs all sites using www-data which has full access to /var/www and all sub-folders.
For each site I have set up a user & group www-fqdn, added www-data to the www-fqdn group and set recursive 750 permissions at the site root /var/www/fqdn directory. I've then created php-fpm pools for each site pointing at the user & group and a sites-available file to point at the pool. All (I believe) standard stuff and from the website delivery POV works as expected.
Now the bit I'm struggling with. I also want to have FTP access that will allow me (in a case of emergency) write access to the whole /var/www directory tree. I am using ProFTPD as my ftp server. My thought was to create a virtual user with a random bunch of characters as its name in the ftpd.passwd file, which I map to user & group 0 (i.e. root) with a home folder of /var/www:
webxphrs:$5$6kI5e8cKRTDER8WC$t.qPUk5Ex******************FUySMuRZC:0:0::/var/www:/bin/false
(Before anyone comments, yes I know this is technically a breach of security, but with a random username which is stored only in my KeePass safe it's pretty good, and way better than having www-data own everything.)
The problem is it doesn't work! When I connect using FileZilla I see the directory structure under /var/w OK, but as soon as I try to access any individual site directory it fails 'permission denied'. In order to get write access I need to change the site's permissions to 777, i.e. I need to provide 'others' with access. Looking using htop I can see that the process running the connection is using the root user. If I sudo -s I can copy files into the same folder, exactly as you would expect. Why then when running via ProFTPD am I not getting the same access?
This is in my proftpd.conf file:
# Adding in a directive to read the ftpd.passwd file before checking
# using a system user account
AuthOrder mod_auth_file.c mod_auth_unix.c
# Path to the virtual user file you just generated
AuthUserFile /etc/proftpd/ftpd.passwd
# Allow use of root (which the virtual user needs to allow full accesss to
# /var/www, where it is jailed in the ftpd.passwd file
RootLogin on
UseFtpUsers off
# Jail the virtual user to their designated home directory for security
DefaultRoot ~ !root
What am I missing? Why is this not working? Although it's for emergency use only and I can in such a circumstance set 777 permissions I would prefer not to, plus I'm concerned I don't fully understand the issue so would appreciate an explanation. All input welcomed; I've searched this site and nothing exactly matches my issue, plus I've cross-posted this is a few forums as I am unsure where the point of failure is (other than within my brain!).
Tia, Graham