What is the correct way to setup Drupal file permissions on a VPS? [duplicate]

Question

I am testing a Drupal site on Google Compute Engine. I have a problem with file permissions.

I would like to be able to access and edit my files trough SFTP and still have Drupal functioning as it's supposed to.

Letts say my user for SFTP is 'user'. If I do sudo chown user:www-data -R /var/www/ I can edit files via SFTP. But then I can not make changes or add files in Drupal (for example add a new module trough Drupal, even clearing caches doesn't seem to work).

If I do sudo chown www-data:www-data -R /var/www/ evrything in Drupal works, but I can not make changes to files trough SFTP.

I have tried adding both users ('user' and 'www-data') to a group called 'drupal' and running the command sudo chgrp drupal -R /var/www/ but this doesn't fix the problem.

Answer 1

user:www-data are the correct permissions IMO. For security reasons, the web server should not be able to write to the file system, except for files and temp folders. You haven't mentioned suhosin or anything so I'm assuming you have a typical setup.

Drupal have unfortunately made the above a bit confusing by including a method to update modules via the UI (v. bad idea IMO, swapping security for convenience).

If you still want to do it, it can be solved with *nix permissions on most platforms; the exact nature will depend on your server's architecture and setup. There's an example here and in the comments of the official docs page to get you going, but generally speaking just search for how to manage these permissions for your server type generically - there's nothing Drupal specific about the commands you need to run, so you're closing off a lot of potential help if you include Drupal as a keyword in your searches.