This was originally posted on stackoverflow, but it was recommended that I post it here: https://stackoverflow.com/questions/23274818/apt-get-installation-of-nginx-leaves-files-owned-by-root/23346149
I'm coming to nginx after years of using apache httpd. I used apt-get to install the nginx server and notice that all the files are owned by root.
debian@nginx-explore:~$ ls -la /usr/share/nginx/www/
total 16
drwxr-xr-x 2 root root 4096 Apr 23 21:09 .
drwxr-xr-x 3 root root 4096 Apr 23 21:09 ..
-rw-r--r-- 1 root root 383 Jul 7 2006 50x.html
-rw-r--r-- 1 root root 151 Oct 4 2004 index.html
The master process is also owned by root, although there are worker processes running as www-data
debian@nginx-explore:~$ ps aux|grep nginx
root 2724 0.0 0.1 62348 1324 ? Ss Apr23 0:00 nginx: master process /usr/sbin/nginx
www-data 2725 0.0 0.1 62688 1624 ? S Apr23 0:03 nginx: worker process
www-data 2726 0.0 0.1 62688 1624 ? S Apr23 0:03 nginx: worker process
www-data 2727 0.0 0.1 62688 1624 ? S Apr23 0:03 nginx: worker process
www-data 2728 0.0 0.2 62688 2132 ? S Apr23 0:00 nginx: worker process
In Apache, it was always stressed to make sure files and processes were not owned by root as a security measure. Is there some reason this isn't a big deal when using nginx?
Ultimately I need to know whether I should go tweak the ownership for nginx files and folders to keep my system secure.