When deploying web applications on Ubuntu servers, you'll often encounter permission issues where your web directory (/var/www) is owned by the www-data user. Needing to perform remote operations as this user is common, but Ubuntu's default configuration prevents direct SSH access for www-data.

Before proceeding, ensure you have:

• SSH access with sudo privileges
• Basic understanding of Linux user management
• Amazon EC2 instance running Ubuntu (though this applies to most Linux servers)

First, let's verify the current shell assignment for www-data:

grep www-data /etc/passwd

You'll typically see output like:

www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin

To enable shell access:

sudo usermod -s /bin/bash www-data

Then create a home directory and set proper permissions:

sudo mkdir /home/www-data
sudo chown www-data:www-data /home/www-data
sudo chmod 755 /home/www-data

Edit your SSH daemon configuration:

sudo nano /etc/ssh/sshd_config

Add or modify these lines:

AllowUsers www-data your_username
PasswordAuthentication no
Match User www-data
    ChrootDirectory %h
    ForceCommand internal-sftp
    X11Forwarding no
    AllowTcpForwarding no

Generate SSH keys for secure access:

sudo -u www-data ssh-keygen -t rsa -b 4096
sudo mkdir /home/www-data/.ssh
sudo touch /home/www-data/.ssh/authorized_keys
sudo chown -R www-data:www-data /home/www-data/.ssh
sudo chmod 700 /home/www-data/.ssh
sudo chmod 600 /home/www-data/.ssh/authorized_keys

After restarting SSH (sudo systemctl restart sshd), test with:

ssh -i /path/to/private_key www-data@your-server-ip

For SCP transfers:

scp -i /path/to/private_key local_file.txt www-data@your-server-ip:/var/www/html/

• Always use key-based authentication
• Regularly rotate SSH keys
• Monitor auth logs (/var/log/auth.log)
• Consider implementing fail2ban

If connection issues arise, check:

sudo tail -f /var/log/auth.log
sudo ls -ld /home/www-data

Common permission problems often relate to:

sudo chown www-data:www-data /home/www-data
sudo chmod 755 /home/www-data

---

When deploying web applications on Ubuntu servers, we often face permission issues where the web directory is owned by www-data but we need secure file transfer capabilities. Here's a comprehensive solution for enabling SSH/SCP access specifically for the www-data user.

First, let's verify if www-data has a valid shell:

grep www-data /etc/passwd
# Typical output: www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin

Modify the shell assignment in /etc/passwd:

sudo usermod -s /bin/bash www-data

Edit your sshd_config file:

sudo nano /etc/ssh/sshd_config
# Add or modify these lines:
AllowUsers www-data your_username
PermitRootLogin no
PasswordAuthentication no

Generate SSH keys for www-data:

sudo -u www-data mkdir -p /var/www/.ssh
sudo -u www-data ssh-keygen -t rsa -b 4096 -f /var/www/.ssh/id_rsa
sudo -u www-data touch /var/www/.ssh/authorized_keys
sudo -u www-data chmod 600 /var/www/.ssh/authorized_keys

Set proper permissions for the .ssh directory:

sudo chown -R www-data:www-data /var/www/.ssh
sudo chmod 700 /var/www/.ssh

Verify your setup:

ssh -i /path/to/private_key www-data@your_server_ip
# Should log you in as www-data

Always combine this with:

• Firewall rules limiting SSH access
• Fail2ban protection
• Regular security updates

If connection fails:

sudo tail -f /var/log/auth.log
# Common errors include:
# - Permission denied (publickey)
# - Could not create directory '/var/www/.ssh'

For pure file transfer without shell access:

sudo usermod -s /usr/lib/openssh/sftp-server www-data
# Then use scp with:
scp -i /path/to/key file.txt www-data@host:/path/