I am running nginx, which I understand runs under the www-data user account.
All my wordpress related files are currently set to root root, is this normal? Or should they be set the www-data account (and group?)
Add a comment
|
3 Answers
I think they should be chowned to www-data:www-data. This is somewhat more secure, because if your site gets compromised, and you had a file that was owned as root, and had the executable permissions, it would be a hell of a lot easier to run a command as root, than if all the files and directories were owned by a non-privileged user.
As long as nginx runs as www-data, you shouldn't have any trouble having the files owned by the same user
answered Nov 28, 2010 at 2:24
-
If an executable or script is owned by root does not means that it will run as root. As an example all system binaries are owned by root, still, you run them as your user. The only exception are the SUID binaries. Nov 29, 2010 at 21:02
-
If it doesn't need to be owned by root, it shouldn't be. Simples! </meerkat> Nov 29, 2010 at 23:50
a issue you may face is automatically installing plugins in the WordPress admin will require you to login via FTP/SFTP if the files aren't owned by www-data.
-
so its a win win scenerio if I change it to www-data then, both security and plugin installation wise?– BlankmanNov 28, 2010 at 2:50
-
Nope. It is not secure. If the application has a flaw, then a remote user can write any php and then run any command as www-data. Nov 29, 2010 at 2:28
For best security I wold use a different user than www-data, except for the folders that I want to be writable by the application (like image upload folder). This user can be root, but it is better, if you are not the programmer, to be owned by a generic application user like wordpress.
answered Nov 28, 2010 at 5:21
