With nginx, should all files being served be owned by www-data? (assuming nginx is running under the context of www-data).

Or is root ok?


For 99.9% of situations the web pages should absolutely not be writable by the www daemon. This includes the www daemon owning the files or directories. I've found it to be very common for root to own the files/directories, 644/755.

If there's an exploit of any kind, it'll be more likely that your website can be modified, defaced, infected with malware, or any one of a hundred other scenarios when owned/writable by the daemon.

  • but if a wordpress plugin needs to modify a file, should that be owned by www-data or root? – Blankman Jun 14 '10 at 14:19
  • Yeah, in the rare instance that the daemon does need to modify the file directly, that specific file(s) should be writable. You can accomplish that either way you think is appropriate for your environment, www owning it and owner-writable; or root owned and other-writable. I personally prefer the second, because www only ever represents "other" users to me; and this keeps my ownership consistent. – Chris S Jun 14 '10 at 15:27
  • @Blankman: PHP should run in another user context than nginx. This is actually quite easy since you need to spawn the php-cgi processes externally anyway. – joschi Jun 14 '10 at 16:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.