I haven't been able to find a satisfying answer on Goole or the various Stack forums:

I noticed that files under /var/www (where nginx and I believe Apache are chrooted by default) have permissions mostly of root:daemon or root:bin. This is true of roundcube and I assume other web applications if installed from official packages. The nginx user, www, doesn't appear to be part of either daemon or bin, so files need to have the read flag set for other for them to be served by nginx.

So the question is: should I follow suit in my own applications and make files owned by root:daemon or root:bin as long as they are in the chroot environment? Or is it ok to do what I normally do on other systems and make them www:www?

This is my first question here, so hopefully it's specific enough.


recent versions of OpenBSD include Nginx in it's base. Apache is gone for good. so to answer your question properly it is important to know what version of OpenBSD you are using. if you are not on 5.5 yet an update is very much recommended.

in general, you should only and carefully change permissions for directories and/or files which require write access. regardless of a chroot environment, this is done to protect your server in case of a remote hole or so to prevent files from being changed (to include malware or stuff). i do advise you to not do things like "on other system". while openbsd is a POSIX compliant UNIX it is different, otherwise it would just have as many holes as "other systems".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.