Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Disclaimer: Before anyone makes a smart mention of Google (or the like), I'd just like to note that I'm posing this question because I couldn't find an article or articles to my liking.


Preface:

Amazon EC2 Micro instance (VPS) with Ubuntu 10.10 Server + nginx + php-fpm + Wordpress.

Question:

Obviously there's no right or wrong answer, but nonetheless -- given my stack, what directory structure && file user/group permissions would you recommend?

Of course security is always a concern, so the ideal structure/permissions wouldn't have security risks (ex: chmod 777 wp-content) but should also have no problem functioning properly (uploading images to wp-content, plugins). Also, remember that we're dealing with Nginx rather than Apache.

I've tried a number of solutions, none of which I'm happy with thus far. Hoping to get some better ideas!

share|improve this question
    
Anyone want to weigh in? I'd really appreciate some feedback! –  Dan Simmons Apr 21 '11 at 18:41
add comment

2 Answers 2

Put WordPress in the root directory defined with server location in your nginx sites-enabled/site-name.conf

Use SVN to download and install WordPress

$ cd public_html

$ svn co http://core.svn.wordpress.org/tags/3.1.2 .

chown www-data:www-data public_html/ -R

Make sure Nginx is running as www-data or change the user and group to nginx above

When WordPress is installed all categories will be 755 and files will be 644 which is secure

share|improve this answer
    
I understand that WordPress should be located where the nginx virtual host thinks the root directory is. However, I was wondering where that should be (ex: /var/www, ~/), who should the owner, and resultantly, the permissions that will allow a secure WordPress setup that functions normally. I currently have www-data:www-data in /srv/www –  Dan Simmons Apr 27 '11 at 6:36
    
I always like using /srv/www/domain-name/public_html when running multiple sites. On my dedicated server I'm running a large Multisite setup and it lives in /srv/www/wordpress/public I also use symbolic links in the blogs.dir folder to point to a folder I created for each site at /srv/www/sitename. As long as Nginx knows your document root it can be whatever you want it to be. –  Chris_O Apr 27 '11 at 6:44
add comment

I'm putting together a guide on this at the moment for the very reason that there is not a lot of good info out there about how best to configure the exact architecture you describe above.

My config is similar to Chirs_O's config described above.

/srv/www/

/site1.com/logs
/site1.com/public_html

/site2.com/logs
/site2.com/public_html

/site3.com/logs
/site3.com/public_html

In a situation where I'm the only admin who needs to manage files under each site I'll typically change file ownership to a specific user to ensure I can easily scp/ftp files from local to each site.

I typically use the following command

chown -R myuser:myuser /site1.com

This allows me to transfer files with no permissions issues and is also a good secure setup for serving these files.

The downside to this config is that you'll hit all sorts of problems with plugin installs, wordpress updates etc. (and image uploads).

Before I do plugin installs, wordpress updates I typically change ownership of a site from myuser to www-data using the same command

chown -R www-data:www-data /site1.com

I then install whatever plugins I need and then reset permissions back to myuser.

Some people leave www-data as the main owner but I understand this is not a great security setup but I've come across a permissions config for nginx/php5-fpm yet that provides ease of file transfer under individual ftp/ssh accounts while allowing WordPress plugin installs/updates to be done without the need for setting 777 permissions on specific folders which is a pain and has it's own security issues.

I'm currently exploring an alternative config where I setup individual vhosts directly within each users individual accounts e.g.

/home/myuser/www/site1.com/public_html

This ensures the ftp/ssh account for that user is restricted to their own home account. There currently would still be the need to change ownership back to www-data for wordpress updates etc. but I'm trying to figure out if there is a secure way that these user accounts can be added to the www-data group to allow a best of both world's scenario. Will let you know if I get a working config.

share|improve this answer
    
Thanks! Please post a link to that guide when you're finished! I'd be interested to read/share it. –  Dan Simmons May 13 '11 at 4:08
    
Hey Dan, the guide is a work in progress but I've published a blog post covering my newest config which I think you'll be interested in. It's also pretty secure too as it utilises separate process pools running under their own user accounts kind of like how suPHP works. Link is here: themesforge.com/performance/… –  Ed Bloom May 14 '11 at 23:53
    
Fantastic article! I'd definitely be interested to read further. Perhaps you could shed light on your Nginx vhost configuration and/or how you have your particular users/groups structured (as far as permissions go, both for individual processes and for files/directories)? –  Dan Simmons May 16 '11 at 3:12
    
@Dan - thanks! Yes I'm currently writing up a blog post around my nginx config and the exact user permissions I'm using - it's probably a week away from being finished as it's something I'm doing when I get time away from more pressing tasks. I'll ping you when it's out! –  Ed Bloom May 19 '11 at 11:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.