0

This was originally posted on stackoverflow, but it was recommended that I post it here: https://stackoverflow.com/questions/23274818/apt-get-installation-of-nginx-leaves-files-owned-by-root/23346149

I'm coming to nginx after years of using apache httpd. I used apt-get to install the nginx server and notice that all the files are owned by root.

debian@nginx-explore:~$ ls -la /usr/share/nginx/www/
total 16
drwxr-xr-x 2 root root 4096 Apr 23 21:09 .
drwxr-xr-x 3 root root 4096 Apr 23 21:09 ..
-rw-r--r-- 1 root root  383 Jul  7  2006 50x.html
-rw-r--r-- 1 root root  151 Oct  4  2004 index.html

The master process is also owned by root, although there are worker processes running as www-data

debian@nginx-explore:~$ ps aux|grep nginx
root      2724  0.0  0.1  62348  1324 ?        Ss   Apr23   0:00 nginx: master process /usr/sbin/nginx
www-data  2725  0.0  0.1  62688  1624 ?        S    Apr23   0:03 nginx: worker process
www-data  2726  0.0  0.1  62688  1624 ?        S    Apr23   0:03 nginx: worker process
www-data  2727  0.0  0.1  62688  1624 ?        S    Apr23   0:03 nginx: worker process
www-data  2728  0.0  0.2  62688  2132 ?        S    Apr23   0:00 nginx: worker process

In Apache, it was always stressed to make sure files and processes were not owned by root as a security measure. Is there some reason this isn't a big deal when using nginx?

Ultimately I need to know whether I should go tweak the ownership for nginx files and folders to keep my system secure.

1
  • 1
    Files that are owned by root:root with 0644 are usually fine, since nothing other than root can change them. I am not sure what you think the problem would be. Can you point to the particular article references you are talking about related to the issue? I think you may have been miss-interpreting them.
    – Zoredache
    Apr 29, 2014 at 17:11

2 Answers 2

0

It's supposed to be like this. The worker processes can still read the files it requires, but it should never need to write a file unless you have an application that specifically needs this option.

0

"In Apache, it was always stressed to make sure files and processes were not owned by root as a security measure."

That's not quite true. For both Apache and nginx

  • The master process will run as root and the worker processes will run as another user
  • The worker processes should have permission to read, but not to write, the content they're serving
2
  • For Apache, I've only ever seen a process running under the Apache user. Are you saying there's another Apache process running as root that delegates processing to the process running under Apache? May 1, 2014 at 2:34
  • Look at one of your apache processes running as the apache user. What user is it's parent process running as?
    – sciurus
    May 1, 2014 at 12:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .