Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

With nginx, should all files being served be owned by www-data? (assuming nginx is running under the context of www-data).

Or is root ok?

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

For 99.9% of situations the web pages should absolutely not be writable by the www daemon. This includes the www daemon owning the files or directories. I've found it to be very common for root to own the files/directories, 644/755.

If there's an exploit of any kind, it'll be more likely that your website can be modified, defaced, infected with malware, or any one of a hundred other scenarios when owned/writable by the daemon.

share|improve this answer
    
but if a wordpress plugin needs to modify a file, should that be owned by www-data or root? –  Blankman Jun 14 '10 at 14:19
    
Yeah, in the rare instance that the daemon does need to modify the file directly, that specific file(s) should be writable. You can accomplish that either way you think is appropriate for your environment, www owning it and owner-writable; or root owned and other-writable. I personally prefer the second, because www only ever represents "other" users to me; and this keeps my ownership consistent. –  Chris S Jun 14 '10 at 15:27
    
@Blankman: PHP should run in another user context than nginx. This is actually quite easy since you need to spawn the php-cgi processes externally anyway. –  joschi Jun 14 '10 at 16:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.