Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible in nginx configure different user per virtual host?

Something like

 server {
     user myprojectuser myprojectgroup;
     ...
 }
share|improve this question

2 Answers 2

up vote 5 down vote accepted

No, because all server stanzas in an nginx config are served from the same set of worker processes. Furthermore, from a security perspective, you're better to run it like that, as it means that the content is automatically unwritable by the webserver (absent stupidities like a chmod -R 0777), so that if there is a vulnerability in nginx, none of the content is at risk.

share|improve this answer
    
So there is no way to hide user's files from another users? All the user's content should be readable by the www-data? –  AlexAtNet Mar 18 '12 at 1:28
1  
Give the document root a group of www-data and perms 0710 when you setup the vhost (since this needs root to configure nginx, it's not a problem to have your automation also set the necessary permissions). Then the contents of the docroot just need to be o+x for directories and o+r for files. –  womble Mar 18 '12 at 2:46
1  
Got it! So the other users cannot enter the document root because they do not have access to it (o-rx). nginx can enter because of www-data and g+x. And then only nginx is the "other" user. Thanks! –  AlexAtNet Mar 18 '12 at 22:25
5  
Beware: if a PHP script (or a cgi-bin process) runs under www-data, every user that can serve a PHP script or a cgi-bin process can access any file accessible to the www-data user. This appears to be non-obvious to anyone who stores database passwords in config.php.inc or similar on a shared machine. –  Ivan Vučica Apr 7 at 18:15
1  
@Ricalsin Remember that UNIX is a multi-user operating system, and servers can have more than one user. For example, peter and john. They are hosting their web pages in ~/public_html. Absent a different approach not mentioned by any of the people discussing this above, a .php script has the same permissions as the web server as it is also executing under www-data. This means that, just like the web server and PHP interpreter, it can read any other .php script. –  Ivan Vučica Jun 3 at 16:59

In response to Ivan's comment above and which seems applicable to the OP. Two things:

1) The application document root would be something like /blah/peterWeb/html and /blah/johnWeb/html. Both NGINX and Apache2 would not allow one to peruse or operate in the other directory even if they are both running www-data as group.

2) Placing each directory tree under their own user permission would allow each user to ssh/login to a UNIX system and keep their directories private to each - just don't put each user into the www-data group. If you agree, then your sentence:

every user that can serve a PHP script or a cgi-bin process can access any file accessible to the www-data user.

might be more accurately written as:

every user that you put in the same group as the apache/nginx server (www-data) can then do whatever they want (including running a php script) in any file that is accessible to it (which would essentially be everything on a web server).

EDIT 1: Having to address some Server Admin issues I looked further into this topic. I was unaware of how accurate Ivan's information was! If you intend to give users the ability to upload and run scripts on a shared hosting configuration then take heed. Here is one approach. Hat tip to Ivan for making sure I understood this vulnerability.

share|improve this answer
1  
No. You're missing it. PHP scripts, when executed in Apache's process (or other web server's) will run under the hosting process privileges. On a large number of naive setups this user is www-data. If Johnny can create a script and have it run under www-data (which on naive setups he can), then Johnny's script can read Peter's scripts and send them back to Johnny. This has nothing to do with groups. Proper solution is to have suPHP (if naively setup, bad, as poorly written code then endangers all of this user's files), or a jail, or dedicated additional web user per user. –  Ivan Vučica Jun 5 at 21:12
    
(Also, adding an answer instead of comment is abuse of StackOverflow-type sites, impressum you're actually providing an answer. Please avoid that.) –  Ivan Vučica Jun 5 at 21:13
    
@IvanVučica Updated and added a helpful link that supports your advice. Thanks. –  Ricalsin Jun 8 at 13:59
    
Upvoting because of link. (Thanks!) –  Ivan Vučica Jun 8 at 14:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.