46

I understand preserving the permissions for rsync. However in my case my local computer does not have the user the files need to under for the webserver. So when I rsync I need the owner and group to be apache on the webserver, but be my username on my local computer. Any suggestions?

I wanted to clarify to explain exactly what I need done.

My personal computer: named 'home' with the user account 'michael' My web server: named 'server' with the user account 'remote' and user account 'apache'

Current situation: My website is on 'home' with the owner 'michael' and on 'server' with the owner 'apache'. 'home' needs to be using the user 'michael' and 'server' needs to be using the user 'apache'

Task: rsync my website on 'home' to 'server' but have all the files owner by 'apache' and the group 'apache'

Problem: rsync will preseve the permissions, owner, and group; however, I need all the files to be owner by apache. I know the not preserving the owner will put the owner of the user on 'server' but since that user is 'remote' then it uses that instead of 'apache'. I can not rsync with the user 'apache' (which would be nice), but a security risk I'm not willing to open up.

My only idea on how to solve: after each rsync manually chown -R and chgrp -R, but it's a huge system and this takes a long time, especially since this is going to production.

Does anyone know how to do this?

Current command I use to rsync:

rsync --progress -rltpDzC --force --delete -e "ssh -p22" ./ remote@server.com:/website
2
  • 1
    You were a little vague about exactly how you're transferring the files -- over ssh, I'm assuming? Are you ssh-ing to the webserver, and if so, as what user? Could you provide the command as you're running it now?
    – Adam
    Jun 21, 2012 at 16:19
  • 1
    I updated my question for a deeper explanation. Yes, im using ssh to rsync to a remote web server. Jun 22, 2012 at 2:05

5 Answers 5

88

If you have access to rsync v.3.1.0 or later, use the --chown option:

rsync -og --chown=apache:apache [src] [dst]

More info in an answer from a similar question here: ServerFault: Rsync command issues, owner and group permissions doesn´t change

4
  • Can't merge cross-site, David - thanks for the crosslink though.
    – Shog9
    Jan 11, 2015 at 4:21
  • 4
    it seems like both client and server should be running 3.1.0+ in order to use --chown.
    – Jacket
    Mar 11, 2016 at 7:08
  • thank you! updated rsync with homebrew on my local machine and this worked like a charm Jan 26, 2017 at 1:40
  • Note that you also need to check that your current user has the permission to run that chown. (Check by running chown apache:apache filename manually)
    – Flimm
    Jul 15, 2020 at 17:55
14

There are hacks you could put together on the receiving machine to get the ownership right -- run 'chmod -R apache /website' out of cron would be an effective but pretty kludgey option -- but instead, I'd recommend securely allowing rsync-over-ssh-as-apache.

You'd create a dedicated ssh keypair for this:

ssh-keygen -f ~/.ssh/apache-rsync

and then take ~/.ssh/apache-rsync.pub over to the webserver, where you'd put it into ~apache/.ssh/authorized_keys and carefully specify the allowed command, something like so, all on one line:

command="rsync --server -vlogDtprCz --delete . /website",from="IP.ADDR.OF.SENDER",no-port-forwarding,no-X11-forwarding,no-pty ssh-rsa AAABKEYPUBTEXTsVX9NjIK59wJ+fjDgTQtGwhATsfidQbO6u77dbAjTUmWCZjKAQ/fEFWZGSlqcO2yXXXXXXXXXXVd9DSS1tjE6vAQaRdnMXBggtn4M9rnePD2qlR5QOAUUwhyFPhm6U4VFhRoa3wLvoqCVtCV0cuirB6I45On96OPijOwvAuz3KIE3+W9offomzHsljUMXXXXXXXXXXMoYLywMG/GPrZ8supIDYk57waTQWymUyRohoQqFGMzuDNbq+U0JSRlvLFoVUZ5Piz+gKJwwiFwwAW2iNag/c4Mrb/BVDQAyEQ== comment@email.address

and then your rsync command on your "home" machine would be something like

rsync -av --delete -e 'ssh -i ~/.ssh/apache-rsync apache@server' ./ /website

There are other ways to skin this cat, but this is the clearest and involves the fewest workarounds, to my mind. It prevents getting a shell as apache, which is the biggest security concern, natch. If you're really deadset against allowing ssh as apache, there are other ways ... but this is how I've done it.

References here: http://ramblings.narrabilis.com/using-rsync-with-ssh, http://www.sakana.fr/blog/2008/05/07/securing-automated-rsync-over-ssh/

1
  • 1
    Thanks. I didn't know that the ssh security can be specific to certain commands. Jun 26, 2012 at 4:18
12

The solution using rsync --chown USER:GROUP [src] [dst] only works if the remote user has write access to the the destination directory which in most cases is not the case.

Here's another solution:

Overview

(srcmachine)  (rsync)   (destmachine)
  srcuser    -- SSH -->   destuser
                             |
                             | sudo su jenkins
                             |
                             v
                          jenkins

Let's say that you want to rsync:

  • From:
    • Machine: srcmachine
    • User: srcuser
    • Directory: /var/lib/jenkins
  • To:
    • Machine: destmachine
    • User: destuser to establish the SSH connection.
    • Directory: /tmp
    • Final files owner: jenkins.

Solution

rsync --rsync-path 'sudo -u jenkins rsync' -avP --delete /var/lib/jenkins destuser@destmachine:/tmp

Read more here:

https://unix.stackexchange.com/a/546296/116861

1
  • This is clean and works great! This should be the recommended/accepted answer now. Apr 3, 2020 at 1:42
11

Last version (at least 3.1.1) of rsync allows you to specify the "remote ownership":

--usermap=tom:www-data

Changes tom ownership to www-data (aka PHP/Nginx). If you are using Mac as the client, use brew to upgrade to the last version. And on your server, download archives sources, then "make" it!

1
  • You also need to specify -og and you need to check that the current user has permissions to perform that operation.
    – Flimm
    Jul 15, 2020 at 17:55
3

rsync version 3.1.2

I mostly use windows in local, so this is the command line i use to sync files with the server (debian) :

user@user-PC /cygdrive/c/wamp64/www/projects

$ rsync -rptgoDvhnP --chown=www-data:www-data --exclude=.env --exclude=vendor --exclude=node_modules --exclude=.git --exclude=tests --exclude=.phpintel --exclude=storage ./website/ username@hostname:/var/www/html/website

-n : perform a trial run with no changes made, to really execute the command remove the -n option

1
  • You also need to check that the current user has permission to perform that chown.
    – Flimm
    Jul 15, 2020 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.