Nginx user/group config [closed]

Question

I'm new to nginx, but over the past couple of days I've been learning about the features and all it has to offer. I'm running nginx in Centos 6.3.

I've installed nginx with php-fpm but have a few questions about users and groups.

1. When I install nginx it sets the user/group to nginx. I've set up my box to have all the server block accounts (vhosts) in /accounts/example.com/public_html. Right now the folders are all owned by root/root do I need to change any of the folders to nginx/nginx?

2. Setting up php-fpm pool accounts. I have one php-fpm conf file located in the /etc/php-fpm.d folder that is called www.conf. The user and group in that file are www/www. I'm assuming that this is the default conf file if I'm not running pools. If I don't run pools should the user/group change to nginx/nginx?

3. If I'm going to be running php-fpm pools should the user in the /etc/php-fpm.d/domainname.conf reflect the same user/group that I set up in question 1.

4. Should the user/group listed in the nginx.conf be the same as the php-fpm config?

I'm really confused about the user and groups setup for vhosts (I know that is an apache term) I'm just trying to figure what user/groups I have to add, what folder permissions I have to change... etc.

If someone could just give me a little FYI on what folders need to have what permissions on the setup I have running it would help me a lot. Everyone of the tutorials on the web seem to pass over user/group/folder permissions except when it's a log file/folder.

Any help would be much appreciated! Thanks!

Answer 1

Your 4 questions are really one question. So, I'll answer as one question.

First, you can't think of ownership without consideration of permissions. Consider a permission of 777, that means read, write and execute by anyone in the system. So, if a permission is 777, it doesn't matter who owns it, your nginx can fetch it, your it can be executed, and etc. So, even if you have root:root, it really doesn't matter. But that would be less than optimal in terms of security and cleanliness.

Think what nginx needs to do. What does nginx do? It does...

1. Reads static files.
2. Passes off php processor like php-fpm.

So, as long as the permissions are greater than 4 (ie. can read), nginx won't have any problems.

Next, what does php-fpm need to do? It does...

1. Read the file that it's been passed to.
2. If the file writes to disk, you need write permission.

One thing to take in mind is that php-fpm is the executable, not your PHP script. So the script does not require executable permission. PHP-FPM executes according to instruction given by PHP. (Unless your intent is to make an executable PHP file)

---

So, with that as the foundation, let's try asking the questions.

1. Should nginx be the owner? If you want it to be.
2. Should php-fpm be the owner? If you want it to be.
3. Should other pools have different owner? If you want it to be.
4. Should nginx and php-fpm use the same user? If you want it to be.

Well, that wasn't very helpful, was it? :P

But! If you think who should be allowed the greater permission, and who least ( user ≥ group ≥ other ) in order to work, the answer should come to you. If the permission is 775, who needs the 7? Who can still get away with a 5? Who else needs a 7? That is, who else needs to be in that "group"?

Though I avoided giving you the fish, I feel that should be all you need to know to fish yourself. And welcome to SF.