Recommended Free Tools
A successful SSH login proves that the VPS accepted your identity; it does not prove that the account can write to the remote directory. Find the exact account and path, check traversal permission on every parent directory, then repair access with a staging directory, a controlled deployment group, or a narrowly scoped ACL. Do not make the web root world-writable with chmod -R 777.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What “permission denied” means on a VPS
File transfers involve two separate decisions. SSH first authenticates an account, key, or password. The remote operating system then authorizes that account to traverse directories and create, replace, or delete entries. Passing the first check does not imply passing the second.
As an Amazon Associate I earn from qualifying purchases.
For example, deploy may authenticate successfully but still be unable to upload to /var/www/site because the directory belongs to root:web, because the account lacks execute permission on /var/www, or because an ACL or security policy denies the operation. A file’s mode is not the only factor: creating a file requires write and execute permission on its containing directory, and reaching that directory requires execute permission on every parent.
| Message or symptom | What it usually indicates | First check |
|---|---|---|
Permission denied while creating a remote file |
The authenticated account cannot write to the destination directory, or a parent directory blocks traversal. | Run id, namei -l, and ls -ld on the complete path. |
Permission denied while replacing an existing file |
The account may be able to read the file but not write the containing directory. Ownership of the existing file alone does not grant replacement rights. | Inspect the directory mode, group, ACL, and immutable attributes if applicable. |
Permission denied (publickey) |
Authentication failed before a remote shell or transfer subsystem started. | Check username, key, host, port, local .ssh ownership, and private-key mode. |
| Upload succeeds, but the web server cannot read the result | The deployment account can write, but the service account lacks read or traverse permission, or a security context is wrong. | Check the service account’s access, group/ACL entries, and SELinux context where enabled. |
| Only some files fail | Those paths may have different owners, ACLs, modes, mount points, or immutable flags. | Compare a failing path with a working sibling using stat, getfacl, and namei -l. |
Trace the exact account and path before changing anything
Run the diagnostic from your workstation, replacing only the host name and account with the values you actually use:
#1 Best Overall
- USB-C 2-in-1 storage OTG: The Lexar JumpDrive Dual Drive D40E features USB Type-A and Type-C connectors in a slim, portable form factor for easy device compatibility
- Transfer speeds up to 100MB/s: Based on internal testing, performance may vary depending upon the host device, interface, and usage conditions. 1MB=1,000,000 bytes
- Plug and Play: Widely compatible with USB Type-C smartphones, tablets, laptops, Macs, and traditional Type-A devices, no software installation required. The 360° swivel design allows for easy switching between connectors without the hassle of losing a cap
- Durable & Compact: The Lexar D40E USB memory stick features a metal enclosure, withstands temperatures from 0° to 50° C (32°F to 122°F), and is lightweight at 26g with dimensions of 70.4 x 16.9 x 11.7mm
- Security & Warranty: Securely protects files using an advanced security software solution with 256-bit AES encryption. Backed by a Lexar 3-year limited warranty
ssh user@host 'id; namei -l /var/www/site/file.txt; ls -ld /var/www /var/www/site'This single command reveals three important facts:
idshows the effective user ID and supplementary groups on the VPS. A group added recently will not appear in an already-open SSH session; reconnect after changing group membership.namei -lwalks the path component by component. Look for a parent directory where the account, one of its groups, or an ACL lacks execute (x) permission. Execute on a directory means “may traverse”; it is required even when the final file is readable.ls -ldshows the owner, group, and basic mode of the relevant directories. The trailing slash is significant when checking a directory rather than its contents.
If namei is unavailable, inspect each component individually:
ls -ld / /var /var/www /var/www/siteDo not diagnose using your own interactive account if the transfer uses another one. The account in scp, sftp, or rsync is the account whose rights matter.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRepair the access model instead of widening every permission
Choose the repair that matches how the site is operated. A temporary upload should not require permanently changing ownership of a package-managed web tree. Conversely, a deployment account that publishes releases every day needs a durable group or ACL design rather than repeated manual chmod commands.
Option 1: Upload to a user-owned staging directory
This is the safest default when a release step already runs on the server. Create a directory below the deploy account’s home directory, transfer there, and let a controlled command install the release into the service directory.
sudo install -d -o deploy -g deploy -m 0750 /home/deploy/releases
rsync -az --no-perms --no-owner --no-group ./site/ deploy@host:/home/deploy/releases/site/After the transfer, a privileged release command can validate the files and copy or switch them into place:
sudo cp -a /home/deploy/releases/site/. /var/www/site/Use a service-specific release script when possible so it sets the intended owner, group, modes, and restart behavior in one audited operation. Staging avoids granting the transfer account write access to system directories and makes it easier to reject incomplete uploads.
Rank #2
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
Option 2: Use a shared deployment group
A group is appropriate when several deployers need the same directory and the web service should retain predictable access. The following example creates a group, adds the deploy account, and assigns the site tree to that group:
sudo groupadd --system deployers
sudo usermod -aG deployers deploy
sudo chown -R root:deployers /var/www/site
sudo chmod -R g+rwX /var/www/site
sudo chmod g+s /var/www/siteThe setgid bit on the directory makes newly created entries inherit the directory’s group instead of the creator’s primary group. Reconnect the deploy account so its new group membership is active. If the web server must read files, make sure its account is also in the appropriate group or use an ACL; do not assume that group write permission automatically grants service access.
For a tree where new files must consistently remain group-readable and group-writable, set a default ACL on the directory:
sudo setfacl -m g:deployers:rwx /var/www/site
sudo setfacl -d -m g:deployers:rwx /var/www/site
sudo setfacl -d -m o::--- /var/www/siteDefault ACLs affect entries created beneath that directory. Existing files still need their current ACL or mode corrected, and each parent directory still needs traversal permission.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Option 3: Grant one account a narrowly scoped ACL
Use an ACL when changing group membership would grant access to too many people or services. Grant the deploy account only the rights needed for the specific tree:
sudo setfacl -m u:deploy:rwx /var/www/site
sudo setfacl -m u:deploy:x /var
sudo setfacl -m u:deploy:x /var/wwwThe account needs x on parent directories to reach the site. It needs w and x on the destination directory to create, replace, or remove entries. Inspect the effective result rather than relying on memory:
Rank #3
- What You Get - 2 pack 64GB genuine USB 2.0 flash drives, 12-month warranty and lifetime friendly customer service
- Great for All Ages and Purposes – the thumb drives are suitable for storing digital data for school, business or daily usage. Apply to data storage of music, photos, movies and other files
- Easy to Use - Plug and play USB memory stick, no need to install any software. Support Windows 7 / 8 / 10 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, compatible with USB 2.0 and 1.1 ports
- Convenient Design - 360°metal swivel cap with matt surface and ring designed zip drive can protect USB connector, avoid to leave your fingerprint and easily attach to your key chain to avoid from losing and for easy carrying
- Brand Yourself - Brand the flash drive with your company's name and provide company's overview, policies, etc. to the newly joined employees or your customers
getfacl /var/www/siteAn ACL can be masked by the directory’s ACL mask, so check the effective permissions shown by getfacl. Apply a default ACL only when newly created files and subdirectories should inherit the same policy.
Option 4: Change ownership when the service design calls for it
Changing ownership can be correct for a deploy-owned application tree, but it is a design decision, not a generic error fix:
sudo chown -R deploy:web /var/www/siteBefore using a recursive command, determine whether the directory contains package-managed files, shared uploads, symlinks, container bind mounts, or files that the web server must own. Blindly changing ownership can stop a service from reading or writing its runtime data and can be undone by package upgrades or deployment automation. Prefer changing the smallest subtree that the deploy process actually controls.
Verify the fix as the transfer account
Always test with the same account used by the transfer command. Testing as root proves nothing about a normal deployment user.
sudo -u deploy test -w /var/www/site && echo writable
sudo -u deploy touch /var/www/site/.permission-test
sudo -u deploy rm /var/www/site/.permission-testThe test -w check is a quick indication; the touch and rm checks exercise actual creation and deletion. If the directory should not allow deletion, test creation of a disposable file in a dedicated test directory instead. Remove test files immediately and do not run these commands in a production directory when an automated watcher could publish them.
After changing groups, ACLs, or ownership, start a fresh SSH session and repeat the test. An old session may retain its original supplementary-group list.
Rank #4
- GOOD VALUE PACKAGE - 1 Pack 32GB Memory Stick USB 2.0 Flash Drives with great cost performance and high quality.
- BIG CAPACITY - The available capacity: 29.10GB-29.8GB, You can save the data of movies, music, photos, designs, programs, manuals, handouts in a high speed.Good performance in digital data storing, transferring and sharing with families, friends, workmates, clients and machines.
- EASY TO USE & PLUG AND WORK - Support windows 7 / 8 / 10 / Vista / XP / 2000 / ME / NT Linux and Mac OS, Compatible with USB2.0 and below.
- TWISTTURN DESIGN & EASY CARRY - The metal clip rotates 360° round the ABS plastic body which with rubber oil skin feeling finish. The capless design can avoid lossing of cap, and providing efficient protection to the USB port.
- WARRANTY & SUPPORT - SIMMAX logo is laser printed on the USB connector surface, our products are of good quality and we promise that any problem about the product within one year since you buy.
Choose scp, SFTP, or rsync for the job
| Tool | Best fit | Useful behavior | Permission considerations |
|---|---|---|---|
| scp | A straightforward one-off copy. | Simple source-to-destination syntax; -i selects an identity file. |
The destination directory must already be writable by the remote account. It does not automatically run a privileged command on the server. |
| SFTP | Interactive inspection and transfer. | Commands such as ls -l, put, put -R, chmod, chown, and df help diagnose the remote session. |
put -p preserves permissions and access times when the server supports it; server extensions determine which operations are available. |
| rsync | Repeatable synchronization of a directory tree. | Efficiently transfers changed files and can preserve or deliberately control links, owners, groups, and permissions. | Both ends need rsync for remote transfers. Destination umask and default ACLs affect newly created files. |
scp for a one-off upload
scp -i ~/.ssh/id_ed25519 ./site/index.html deploy@host:/home/deploy/releases/site/The remote path must be writable by deploy. If the final destination is restricted, copy to the staging directory and perform the privileged installation on the VPS. Trying to place sudo in the remote path does not make scp elevate; scp treats that text as a path.
SFTP for interactive diagnosis
sftp -i ~/.ssh/id_ed25519 deploy@host
sftp> pwd
sftp> ls -l /var/www/site
sftp> df /var/www/site
sftp> put ./site/index.html /home/deploy/releases/site/index.html
sftp> put -R ./site /home/deploy/releases/site
Use ls -l to confirm the session sees the path you intended and df to check filesystem capacity when an upload fails unexpectedly. The SFTP server may not implement every optional operation, and a restricted or chrooted configuration can expose a different path namespace from the normal shell.
rsync for repeatable deployments
rsync -az --no-perms --no-owner --no-group ./site/ deploy@host:/home/deploy/releases/site/The --no-perms --no-owner --no-group options leave ownership and modes to the destination policy. This is usually safer when the server’s group, umask, or default ACL is authoritative. If you intentionally need rsync to set controlled modes, use --chmod rather than copying arbitrary workstation permissions. Keep the final service-directory update as a separate server-side step.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →When ordinary owner and mode checks look correct
Linux can deny an operation even when ls -l appears to show the expected owner and permissions. Check the layers below in order.
ACL entries and masks
getfacl /var/www/siteAn extended ACL may deny the account or impose a restrictive mask. Compare a failing directory with a working one, and inspect parent directories too. Remove an obsolete entry only after confirming that no deployment or service depends on it.
SELinux context
ls -Zd /var/www/siteOn systems enforcing SELinux, the security context must permit the service or transfer operation. A mode change alone will not repair a context denial. If files were copied from an unexpected location, an administrator may need to restore the distribution’s expected context with the platform’s documented SELinux procedure. Review the audit log before changing policy; disabling SELinux is not a safe fix.
Best Value
- 【16GB Flash Drive】USB flash drives with 16GB capacity, meet your needs of daily use on work, school, home and travelling for photos, music, videos, files storage and transfer. IMEASON thumb drives can be used to store different files, easy to data backup.
- 【Metal Swivel Cap Design】USB thumb drive is metal swivel cover provides extra protection for the usb thumbdrive connector, no usb drive cap to lose; keychain design makes it easier to carry without worrying lose it.
- 【Wide Compatibility】USB drive supports Windows 7/8/10/11 / Vista / XP / Unix / 2000 / ME / NT Linux and Mac OS, also Supports USB 2.0 and 1.1 ports. USB Stick support TV, desktop, notebook computer, car, audio and other device. The USB Memory Stick is your great data storage and transfer companion with traveling and working.
- 【Easy to use】usb memory stick is plug and play without any software installation. Just simply plug the Flashdrive into the port of your USB-compatible devices such as computer, laptop to start data storage or transmission.
- 【What You Get】16 GB USB Flash Drive Thumb Drive, The default format of the usb storage flash drive is FAT32.
Read-only mounts and filesystem capacity
findmnt -no TARGET,OPTIONS /var/www
df -h /var/www
df -i /var/wwwA read-only mount blocks writes regardless of directory mode. A full filesystem or exhausted inode pool can produce failures that look like ordinary permission problems. Check both data blocks and inodes, then inspect system and mount logs before retrying the transfer.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchSFTP chroot, ForceCommand, and subsystem rules
SSH configuration can restrict SFTP to a chroot, force a command, or select a subsystem with a different view of the filesystem. The path shown by an SFTP client may be relative to the chroot rather than the VPS root. Compare the account’s shell session with its SFTP session and inspect the effective SSH server configuration through your administration process. A directory outside the chroot cannot be reached merely by typing its absolute-looking name.
Containers and bind mounts
If /var/www/site is a bind mount or a container volume, the owner visible on the host may not match the numeric user ID inside the container. Check the mount definition and the container’s effective UID/GID before changing host ownership. A container startup script can also reset permissions after every deployment, making a manual fix temporary.
Automations that rewrite permissions
Release scripts, package hooks, synchronization jobs, and service startup routines may run chown or chmod after an upload. If access works immediately and fails later, review those jobs and their logs. Put the intended ownership and mode in the authoritative deployment step rather than repeatedly repairing symptoms.
Fix an SSH authentication error separately
If the message is Permission denied (publickey) before a remote command starts, investigate authentication rather than /var/www. Confirm the username, host, port, and identity file:
ssh -v -i ~/.ssh/id_ed25519 -p 22 user@hostOpenSSH also rejects unsafe permissions in the local SSH path. Oracle’s OpenSSH guidance gives these baseline examples:
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chown -R $USER:$USER ~/.sshUse the correct private-key filename and ensure the matching public key is installed in the remote account’s authorized_keys. A successful login with one username does not grant access when the transfer command names another.
Quick Recap
A least-privilege deployment workflow
- Identify the transfer account. Copy the exact account from the command and verify it with
ssh user@host 'id'. - Resolve the full destination path. Check every parent with
namei -land confirm whether the path is a normal directory, mount, chroot view, or container volume. - Select the access model. Use user-owned staging for controlled releases, a shared group for a team-managed tree, or an ACL for one narrowly scoped exception.
- Apply the smallest change. Avoid recursive world-writable modes. Preserve the service account’s required read and execute access.
- Reconnect after group changes. Start a new session so the account receives its updated supplementary groups.
- Test creation as the deploy account. Use
sudo -u deploywith a disposable path, then remove the test entry. - Transfer with the appropriate tool. Use scp for a single file, SFTP when you need interactive inspection, and rsync for repeatable trees.
- Install or activate the release server-side. Set final ownership and modes in one controlled step, then reload the service only if the application requires it.
- Recheck service access. Confirm that the web server or application account can read the published files and traverse every parent directory.
- Monitor for regressions. If permissions change again, inspect deployment jobs, package hooks, container startup scripts, and mount behavior instead of applying another broad chmod.
Common mistakes that make the problem worse
- Using
chmod -R 777. This grants every local user and process write access and hides the real ownership or ACL problem. It can allow unauthorized file replacement in a web-served directory. - Changing only the file mode. Uploading or replacing an entry is controlled primarily by the containing directory, while reaching it depends on all parent directories.
- Testing as root. Root bypasses normal discretionary permission checks, so a successful root test does not validate the deployment account.
- Assuming SSH login equals upload permission. Authentication and filesystem authorization are separate checks.
- Copying workstation ownership and modes blindly. rsync can preserve metadata that conflicts with the server’s service account, umask, or ACL policy. Use the no-preserve options when destination policy should win.
- Changing ownership of an entire web root without inventory. Package files, sockets, uploads, and container mounts may require different owners.
- Ignoring disk and inode exhaustion. A full filesystem can fail a transfer even when every directory mode is correct.
Quick decision checklist
- If login fails with
publickey, fix the username, key, host, port, or local SSH permissions first. - If login works but a destination write fails, run
id,namei -l, andgetfaclas the transfer account. - If only a protected service directory is involved, upload to a user-owned staging directory and install through a controlled release step.
- If several trusted deployers need ongoing access, use a deployment group, setgid directories, and an appropriate default ACL.
- If one account needs a narrowly scoped exception, grant an ACL and verify the ACL mask and parent traversal rights.
- If permissions appear correct, inspect SELinux context, mount options, blocks, inodes, SFTP restrictions, container UID/GID mappings, and jobs that rewrite metadata.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
