Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This was originally posted on stackoverflow, but it was recommended that I post it here: http://stackoverflow.com/questions/23274818/apt-get-installation-of-nginx-leaves-files-owned-by-root/23346149

I'm coming to nginx after years of using apache httpd. I used apt-get to install the nginx server and notice that all the files are owned by root.

debian@nginx-explore:~$ ls -la /usr/share/nginx/www/
total 16
drwxr-xr-x 2 root root 4096 Apr 23 21:09 .
drwxr-xr-x 3 root root 4096 Apr 23 21:09 ..
-rw-r--r-- 1 root root  383 Jul  7  2006 50x.html
-rw-r--r-- 1 root root  151 Oct  4  2004 index.html

The master process is also owned by root, although there are worker processes running as www-data

debian@nginx-explore:~$ ps aux|grep nginx
root      2724  0.0  0.1  62348  1324 ?        Ss   Apr23   0:00 nginx: master process /usr/sbin/nginx
www-data  2725  0.0  0.1  62688  1624 ?        S    Apr23   0:03 nginx: worker process
www-data  2726  0.0  0.1  62688  1624 ?        S    Apr23   0:03 nginx: worker process
www-data  2727  0.0  0.1  62688  1624 ?        S    Apr23   0:03 nginx: worker process
www-data  2728  0.0  0.2  62688  2132 ?        S    Apr23   0:00 nginx: worker process

In Apache, it was always stressed to make sure files and processes were not owned by root as a security measure. Is there some reason this isn't a big deal when using nginx?

Ultimately I need to know whether I should go tweak the ownership for nginx files and folders to keep my system secure.

share|improve this question
1  
Files that are owned by root:root with 0644 are usually fine, since nothing other than root can change them. I am not sure what you think the problem would be. Can you point to the particular article references you are talking about related to the issue? I think you may have been miss-interpreting them. –  Zoredache Apr 29 at 17:11

2 Answers 2

It's supposed to be like this. The worker processes can still read the files it requires, but it should never need to write a file unless you have an application that specifically needs this option.

share|improve this answer

"In Apache, it was always stressed to make sure files and processes were not owned by root as a security measure."

That's not quite true. For both Apache and nginx

  • The master process will run as root and the worker processes will run as another user
  • The worker processes should have permission to read, but not to write, the content they're serving
share|improve this answer
    
For Apache, I've only ever seen a process running under the Apache user. Are you saying there's another Apache process running as root that delegates processing to the process running under Apache? –  Daniel Watrous May 1 at 2:34
    
Look at one of your apache processes running as the apache user. What user is it's parent process running as? –  sciurus May 1 at 12:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.