Nginx: Difference between user nginx and www-data in terms of security permissions?

Question

I recently installed nginx 1.13.1 on an Ubuntu instance in Amazon Lightsail.

Ubuntu version is 16.04 Xenial OS. Nginx was installed using the Nginx.org package repository.

After installation, the default nginx.conf specifies user as:

user nginx;

I started the nginx using the below command:

sudo service nginx start

On checking the status of nginx using:

ps -ef | grep nginx

I found that worker process is owned by nginx user.

Now as per various resources available online, people suggest to use 'www-data' as the user.

My queries related to above scenario is:

1. Is there any difference in security permissions for nginx and www-data user?

2. Should I change user to 'www-data' if it is more secure?

I am new to Linux and nginx so any help will be appreciated.

Answer 1

No, there is no real difference in security just by changing the process owner name. The name itself doesn't imply any permissions or restrictions. In Linux, you have to assign permissions to said user. The name is just an identifier. If security through obscurity is something you believe in, you could change all such defaults to something more random/personal, just to slow down potential hackers in future, but it's hardly worth it. They would just have to look up the new name instead of already knowing the defaults.

So no, no need to change the default user.

But of course, do pay attention to that user's permissions, in terms of executing rights, file read and write rights etc. That's not specific to Nginx, but at the OS level so read up on that to feel more confident in your stack's security.