Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm new to nginx, but over the past couple of days I've been learning about the features and all it has to offer. I'm running nginx in Centos 6.3.

I've installed nginx with php-fpm but have a few questions about users and groups.

  1. When I install nginx it sets the user/group to nginx. I've set up my box to have all the server block accounts (vhosts) in /accounts/example.com/public_html. Right now the folders are all owned by root/root do I need to change any of the folders to nginx/nginx?

  2. Setting up php-fpm pool accounts. I have one php-fpm conf file located in the /etc/php-fpm.d folder that is called www.conf. The user and group in that file are www/www. I'm assuming that this is the default conf file if I'm not running pools. If I don't run pools should the user/group change to nginx/nginx?

  3. If I'm going to be running php-fpm pools should the user in the /etc/php-fpm.d/domainname.conf reflect the same user/group that I set up in question 1.

  4. Should the user/group listed in the nginx.conf be the same as the php-fpm config?

I'm really confused about the user and groups setup for vhosts (I know that is an apache term) I'm just trying to figure what user/groups I have to add, what folder permissions I have to change... etc.

If someone could just give me a little FYI on what folders need to have what permissions on the setup I have running it would help me a lot. Everyone of the tutorials on the web seem to pass over user/group/folder permissions except when it's a log file/folder.

Any help would be much appreciated! Thanks!

share|improve this question
add comment

1 Answer

Your 4 questions are really one question. So, I'll answer as one question.

First, you can't think of ownership without consideration of permissions. Consider a permission of 777, that means read, write and execute by anyone in the system. So, if a permission is 777, it doesn't matter who owns it, your nginx can fetch it, your php-fpm can execute it, and etc. So, even if you have root:root, it really doesn't matter. But that would be less than optimal in terms of security and cleanliness.

Think what nginx needs to do. What does nginx do? It does...

  1. Reads static files.
  2. Passes off executables like php to php-fpm.

So, as long as the permissions are greater than 4 (ie. can read), nginx won't have any problems.

Next, what does php-fpm need to do? It does...

  1. Execute the file.
  2. If the executed file writes to disk, you need write permission.
  3. You also obviously need to read.

So, php-fpm would need the greatest permission of 7.


So, with that as the foundation, let's try asking the questions.

  1. Should nginx be the owner? If you want it to be.
  2. Should php-fpm be the owner? If you want it to be.
  3. Should other pools have different owner? If you want it to be.
  4. Should nginx and php-fpm use the same user? If you want it to be.

Well, that wasn't very helpful, was it? :P

But! If you think who should be allowed the greater permission, and who least ( user ≥ group ≥ other ) in order to work, the answer should come to you. If the permission is 775, who needs the 7? Who can still get away with a 5? Who else needs a 7? That is, who else needs to be in that "group"?

Though I avoided giving you the fish, I feel that should be all you need to know to fish yourself. And welcome to SF.

share|improve this answer
    
LOL! Thanks, I like to fish! Last night I bought one of the books on nginx. They have a whole chapter on permissions. What you posted is true. But, like you mentioned, I'm more worried about security and cleanliness... getting everything correct. –  Jim K Jan 22 '13 at 14:52
    
@JimK Just think what the bare minimum would be to allow it's execution. A typical perm of 755 isn't bare minimum but it is one of the more convenient solutions. –  Grumpy Jan 23 '13 at 0:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.