nginx workers are spawned with the value from the user directive. The default value is nobody, but nginx official packages include a default configuration containing user nginx; in nginx.conf, in the main context.
When only a user is specified, the group with the same name is applied to nginx workers.
Default user:group for PHP-FPM is www-data:www-data.
What you could so is making files owned by nginx:www-data which would work out the box. The problem would then be to update files, since any user creating files would need write access.
By default, directories are writeable by its owner (user) but not this user's group, which forces you to either:
- use the
nginxuser to update Web content - add the write access to the
www-datagroup and add the user managing content to this group
To me, both previous solutions are less-than-ideal.
What I would do is making that directory tree owned by the user managing content, use user nginx www-data; to make nginx workers user belonging to the www-data group, and allow the user to read/write, group to read and others nothing (thus a 0640 bitmask for files and 0750 bitmask for directories, allowing traversal for user and group).
To go even further, I would add the setgid bit on directories, to ensure the right group is automatically applied to any directory/file created in the tree. I would thus use the 2640 bitmask on files and 2750 on directories.
You can change the default bitmask for a specific partition at the OS level... or you can stick with the defaults which are a bit less restrictive, but work flawlessly, simply changing ownership and adding the setgid flag.
manpreet![Tuteehub forum best answer]()
Best Answer
2 years ago
I have apache-mpm-itk + php_module setup and user's folders/files belongs to them. But I want to migrate several accounts to nginx + php-fpm.
What should be the right permissions on folders/files if I want to use nginx/php-fpm with virtual hosts which belongs to different users?
For example, user's home:
and permissions is user:user
Here is code from host's nginx conf:
server { listen 8080; server_name domain.com; root /var/www/user/data/www/domain.com/; index index.php index.html index.htm; location / { # First attempt to serve request as file try_files $uri $uri/index.php; } location ~ \.php$ { fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_pass unix:/var/run/php5-fpm/domain.com.socket; fastcgi_index index.php; include fastcgi_params; } }And here is pool config from php-fpm: