# Capistrano Best Practices: Users + Permissions

**URL:** <https://www.ruby-forum.com/t/capistrano-best-practices-users-permissions/137061>\
**Category:** Deployment\
**Created:** [May 8, 2008, 5:04pm UTC](https://www.ruby-forum.com/t/capistrano-best-practices-users-permissions/137061 "2008-05-08T17:04:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mdaoust](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/dbc845/32.png) [@mdaoust](https://www.ruby-forum.com/u/mdaoust)\
**Post date:** [May 8, 2008, 5:04pm UTC](https://www.ruby-forum.com/t/capistrano-best-practices-users-permissions/137061/1 "2008-05-08T17:04:30Z")

</div>

Hello!

What would people recommend for a best practice Capistrano config,  
specifically re: users and permissions? My current config is something  
like:

- Have a non-root user setup on my remote box (which is the web, app +  
db server) - who is a sudoer
- Have a group ‘deployers’ to which that account belongs
- The root user owns the deploy\_to parent directory, but the group owner  
is ‘deployers’ and that directory has 775 permissions.
- The deploy script uses ssh\_agent forwarding to allow it to check out  
the code from another server which is the SVN repository
- The deploy script runs as the non-root user
- The use\_sudo is true (the capistrano default) and sudo is used to  
restart the mongrel cluster and nginx webserver (there are other apps on  
the server too)

Any feedback on this setup – how are other people doing it?

Cheers,

~ Mark

---

<div class="post-metadata">

**Author:** ![mdaoust](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/dbc845/32.png) [@mdaoust](https://www.ruby-forum.com/u/mdaoust)\
**Post date:** [May 8, 2008, 11:27pm UTC](https://www.ruby-forum.com/t/capistrano-best-practices-users-permissions/137061/2 "2008-05-08T23:27:16Z")

</div>

That looks pretty much like how I do things, for whatever that’s  
worth. 🙂

- Jamis

---

<div class="post-metadata">

**Author:** ![mdaoust](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/dbc845/32.png) [@mdaoust](https://www.ruby-forum.com/u/mdaoust)\
**Post date:** [May 10, 2008, 4:30pm UTC](https://www.ruby-forum.com/t/capistrano-best-practices-users-permissions/137061/3 "2008-05-10T16:30:41Z")

</div>

On Thu, 2008-05-08 at 17:04 +0200, Mark D. wrote:

> is ‘deployers’ and that directory has 775 permissions.
> 
> - The deploy script uses ssh\_agent forwarding to allow it to check out  
> the code from another server which is the SVN repository

I prefer using “deploy\_via copy”, but other than that, this looks good  
to me…

Yours,

tom