7

The systemd unit file that comes with the nginx-common package runs the master process as root, which makes me nervous.

I assume the only reason it runs as root is to bind port 80, but being root is overkill for that, so I am running it as a normal user and giving it the CAP_NET_BIND_SERVICE capability.

I have tweaked the unit file to look like this:

[Service]
Type=forking
PIDFile=/var/run/nginx/nginx.pid
ExecStartPre=/usr/sbin/nginx -t -q -g 'daemon on; master_process on;'
ExecStart=/usr/sbin/nginx -g 'daemon on; master_process on;'
ExecReload=/usr/sbin/nginx -g 'daemon on; master_process on;' -s reload
ExecStop=/usr/sbin/nginx -s quit
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
Capabilities=cap_net_bind_service+=ep
user=www-data

Are there any downsides to this approach? Does nginx expect to be root for some other reason? Is there a better way to lock down nginx? I know some people like to chroot it but that seems like a lot of hassle.

  • I'm curious. Do you have this working? I've tried it but couldn't get it working with fedora 19. Directly running setcap did the trick however. – Alexander Kellett Dec 27 '13 at 14:54
  • It has always seemed to work fine, but I still don't know whether it could have introduced some obscure problem or security vulnerability... hence the question ;) – ashleyh Jan 24 '14 at 15:48
4

The master process has to be run as root, otherwise nginx won't be able to bind to port 80, as this is a privileged port.

http://www.w3.org/Daemon/User/Installation/PrivilegedPorts.html

You should instead make sure that the worker processes use a different user. This user can be specified in your nginx.conf.

  • 3
    If you have the CAP_NET_BIND_SERVICE capability then you don't need to be root to bind a privileged port. – ashleyh May 28 '13 at 22:24

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.