I'm running CentOS 6.2 and installed nginx as root. After the install I changed the owner and group of the install to it's own user and group to keep thing a bit more secure.

I logged in as root and ran yum update which updated nginx and I noticed a lot of the file owners groups were reverted back to root.

Is there a way I can retain the ownership I want when performing updates? Maybe login as the nginx user and performing the update (is that even possible or recommended?)

  • Which files' permissions were changed? – Michael Hampton Jul 20 '12 at 20:18
  • @MichaelHampton - The ones in /etc/nginx and also the ones in /usr/share/nginx but I have since moved the files in the latter directory to another location. – ProfessionalAmateur Jul 20 '12 at 20:28
  • I hope you didn't make them owned by nginx. :) – Michael Hampton Jul 20 '12 at 20:32
  • @MichaelHampton - Hrm, I did. I think now I learn why I shouldnt have done that? I created the user and group...? – ProfessionalAmateur Jul 20 '12 at 20:35

What you're doing is bad. Stop it.

If the application nginx is owned by the user nginx and running as the user nginx then when the application is exploited it can write over its own files. You don't want this.

Application binaries should almost always be owned by root. Services should almost always be running as nobody or another similarly non-privleged account.

Likewise, you don't want your web content owned by the same user running the web server because that allows an attacker to change your content (i.e., deface your site).

You want to use as much privilege separation and as few privileges as possible.

  • Applications owned by root (so only root is allowed to modify them)
  • Services executed by non-privileged users (so they have little or no access to the system)
  • Wherever possible the service user should not own the content for that service
  • Thanks, changed ownership back to root and changed the web files back to a normal user – ProfessionalAmateur Jul 23 '12 at 14:15

nginx does not need to be able to write to any of the files you named; and in fact, its ability to do so is a security risk. An attacker who compromised nginx could then write whatever he wanted to your web directory or configuration files. This is why they were owned by root in the first place.

So it appears you made your server less secure, not more secure.

With respect to the web directory, there's not really any need to move the default directory. Instead, make a new nginx server configuration block and place the files for your web site in a common place separate from the default files, such as in the user's home directory, or a directory under /srv. These files can then be owned by the user/group who will be working on them.

  • Doesn't the same risk apply for someone compromising the root user? I thought it would have been better to limit the nginx webserver to its own user for that reason? – ProfessionalAmateur Jul 20 '12 at 20:49
  • If somebody gets root on your machine, you're screwed. root can do anything anyway. – Michael Hampton Jul 20 '12 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.