How to maintain file ownership when running 'yum update'

Question

I'm running CentOS 6.2 and installed nginx as root. After the install I changed the owner and group of the install to it's own user and group to keep thing a bit more secure.

I logged in as root and ran yum update which updated nginx and I noticed a lot of the file owners groups were reverted back to root.

Is there a way I can retain the ownership I want when performing updates? Maybe login as the nginx user and performing the update (is that even possible or recommended?)

Answer 1

What you're doing is bad. Stop it.

If the application nginx is owned by the user nginx and running as the user nginx then when the application is exploited it can write over its own files. You don't want this.

Application binaries should almost always be owned by root. Services should almost always be running as nobody or another similarly non-privleged account.

Likewise, you don't want your web content owned by the same user running the web server because that allows an attacker to change your content (i.e., deface your site).

You want to use as much privilege separation and as few privileges as possible.

• Applications owned by root (so only root is allowed to modify them)
• Services executed by non-privileged users (so they have little or no access to the system)
• Wherever possible the service user should not own the content for that service

Answer 2

nginx does not need to be able to write to any of the files you named; and in fact, its ability to do so is a security risk. An attacker who compromised nginx could then write whatever he wanted to your web directory or configuration files. This is why they were owned by root in the first place.

So it appears you made your server less secure, not more secure.

With respect to the web directory, there's not really any need to move the default directory. Instead, make a new nginx server configuration block and place the files for your web site in a common place separate from the default files, such as in the user's home directory, or a directory under /srv. These files can then be owned by the user/group who will be working on them.