Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently I am running nginx 1.0.11 and PHP-FPM. Each site has it's own user/group and has their home directory in /srv/www/.... I have the PHP-FPM pools set to run as the sites' user and group on separate ports (9001 for site1, 9002 for site2...). Does this do anything to help with security?

nginx is running as www-data:www-data. Currently if I have a PHP script in site1 (/srv/www/ can do this include $_SERVER['DOCUMENT_ROOT'] . "/../../../"; and read that site's files.

How can I prevent this? I looked into chroot but each site's home directory has symlinks to /dotfiles that I need to keep and I assume nginx will need to access logs at /var/logs/nginx/...

share|improve this question
up vote 2 down vote accepted

Have a look at open_basedir. There are a couple known ways to get around it, but these can be prevented in the config.

Why symlinks instead of hard links on the dotfiles?

share|improve this answer
Thanks, I'll look into it. Symlinks because I have some directories in my /dotfiles that I am linking. No way to use chroot with symlinks? – Brandon Jan 17 '12 at 16:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.