Currently I am running nginx 1.0.11 and PHP-FPM. Each site has it's own user/group and has their home directory in /srv/www/.... I have the PHP-FPM pools set to run as the sites' user and group on separate ports (9001 for site1, 9002 for site2...). Does this do anything to help with security?

nginx is running as www-data:www-data. Currently if I have a PHP script in site1 (/srv/www/site1.com/www/public_html/script.php)I can do this include $_SERVER['DOCUMENT_ROOT'] . "/../../../site2.com/www/public_html/index.html"; and read that site's files.

How can I prevent this? I looked into chroot but each site's home directory has symlinks to /dotfiles that I need to keep and I assume nginx will need to access logs at /var/logs/nginx/...


Have a look at open_basedir. There are a couple known ways to get around it, but these can be prevented in the config.

Why symlinks instead of hard links on the dotfiles?

  • Thanks, I'll look into it. Symlinks because I have some directories in my /dotfiles that I am linking. No way to use chroot with symlinks? – Brandon Jan 17 '12 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.