0
votes

I'm migrating my server from weaker to mightier one however I want to make it more organized in the new place.
In the old server there is one user in whos home directory basically most of files, java applications and everything else is placed and Nginx is running under this user too (not www-data). But there are few more users and they have files under their home directories as well and some of nginx configuration is pointing to those some of those directories too. Basically it's a mess old developers had left which I've to clean up.

Any tips on how to keep it more organized? Do I need the Nginx to strictly be running under www-data? As far I understand it should be so for security measures right? Where should I keep files which will be used by Nginx so it would be organized? Do all files used by Nginx must be owned by www-data? Some general guidelines how do you handle these things would be much appreciated.

1 Answer 1

3
votes

On the local level, organization is mostly a function of documentation. Document all the services this system provides and where the files and prerequisites those services require are stored, and you'll be in good shape.

In terms of standard organization, the Filesystem Hierarchical Standard is more or less observed by most distributions of Linux and versions of BSD.

As far as files used by nginix, in most cases you would not want the files to be owned by or writable by the user the webserver is running as, to minimize the damage an attacker could cause if they exploit a hole in the webserver or an application running as the webserver user. The only requirement is that the files that the webserver needs to read or run needs to be readable or executable by the webserver (typically done by using the world/other r and x bits) and that directories need to be at least accessible to the webserver (world x. Without read access, the server cannot autogenerate an index). In most cases, configuration files would be owned by root (root would start the server and nginx would switch to the www-data or other configured user after reading the configuration), user files would be owned by the user responsible for them, and only folders where website users can upload data would be writable by the webserver.

Not the answer you're looking for? Browse other questions tagged .