I am testing a Drupal site on Google Compute Engine. I have a problem with file permissions.

I would like to be able to access and edit my files trough SFTP and still have Drupal functioning as it's supposed to.

Letts say my user for SFTP is 'user'. If I do sudo chown user:www-data -R /var/www/ I can edit files via SFTP. But then I can not make changes or add files in Drupal (for example add a new module trough Drupal, even clearing caches doesn't seem to work).

If I do sudo chown www-data:www-data -R /var/www/ evrything in Drupal works, but I can not make changes to files trough SFTP.

I have tried adding both users ('user' and 'www-data') to a group called 'drupal' and running the command sudo chgrp drupal -R /var/www/ but this doesn't fix the problem.

  • Thanks for linking this. Even though it is not exactly the same question, it did give me answers I needed.
    – puudutus
    Jan 7, 2016 at 11:32

1 Answer 1


user:www-data are the correct permissions IMO. For security reasons, the web server should not be able to write to the file system, except for files and temp folders. You haven't mentioned suhosin or anything so I'm assuming you have a typical setup.

Drupal have unfortunately made the above a bit confusing by including a method to update modules via the UI (v. bad idea IMO, swapping security for convenience).

If you still want to do it, it can be solved with *nix permissions on most platforms; the exact nature will depend on your server's architecture and setup. There's an example here and in the comments of the official docs page to get you going, but generally speaking just search for how to manage these permissions for your server type generically - there's nothing Drupal specific about the commands you need to run, so you're closing off a lot of potential help if you include Drupal as a keyword in your searches.

  • 1
    So what you are saying I should sudo chown user:www-data -R /var/www/ then seperately add permission for www-data user. Is it safe to sudo chown www-data:www-data -R /var/www/html/sites/default/files and sudo chown www-data:www-data -R /var/www/html/sites/all/modules?
    – puudutus
    Jan 7, 2016 at 11:32
  • Depends what you mean by "safe" I suppose, but yeah, that's pretty standard in my experience
    – Clive
    Jan 7, 2016 at 11:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.