Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible in nginx configure different user per virtual host?

Something like

 server {
     user myprojectuser myprojectgroup;
     ...
 }
share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

No, because all server stanzas in an nginx config are served from the same set of worker processes. Furthermore, from a security perspective, you're better to run it like that, as it means that the content is automatically unwritable by the webserver (absent stupidities like a chmod -R 0777), so that if there is a vulnerability in nginx, none of the content is at risk.

share|improve this answer
    
So there is no way to hide user's files from another users? All the user's content should be readable by the www-data? –  AlexAtNet Mar 18 '12 at 1:28
    
Making the files accessable to www-data (or whatever user the webserver runs as) in no way requires that the files are accessable to other users on the system. –  womble Mar 18 '12 at 1:51
1  
Give the document root a group of www-data and perms 0710 when you setup the vhost (since this needs root to configure nginx, it's not a problem to have your automation also set the necessary permissions). Then the contents of the docroot just need to be o+x for directories and o+r for files. –  womble Mar 18 '12 at 2:46
1  
Got it! So the other users cannot enter the document root because they do not have access to it (o-rx). nginx can enter because of www-data and g+x. And then only nginx is the "other" user. Thanks! –  AlexAtNet Mar 18 '12 at 22:25
1  
Beware: if a PHP script (or a cgi-bin process) runs under www-data, every user that can serve a PHP script or a cgi-bin process can access any file accessible to the www-data user. This appears to be non-obvious to anyone who stores database passwords in config.php.inc or similar on a shared machine. –  Ivan Vučica Apr 7 at 18:15
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.