Conventional nginx Installation

Question

I noticed that nginx users tend to create a separate group and user for nginx. Why is this?

Further, the default path for the HTML public directory is /usr/local/nginx/html, but people use the home directory instead (e.g. /home/newuser/mysite.com/public). The same goes for log files and maybe some others. I suppose the reason is the same as for my previous question?

I'm basing this off a script called "centmin", mainly, but I've seen other resources follow the same trend.

score 3 · Accepted Answer · answered May 07 '11 at 17:29

3

Why this is, well, it's really not nginx specific, most every daemon gets its own uid/gid for security reasons. Whether you use a home dir or /usr is totally up to your choice, it more depends on the role of the machine -- with several users , each running from their home dir might make more sense, a dedicated machine might be better off from a system dir...

answered May 07 '11 at 17:29

chx

1,705
2
16
25

Thank you. I forgot to mention I'm still a Linux newbie. Could you elaborate on why it makes things more secure? Just for clarification, if I am running a VPS, would it make more sense to just use /usr? – someguy May 07 '11 at 17:42
1

@someguy: file and process permissions prevents daemons running under different users from accessing the files or processes of other daemons (and users of course). – Lekensteyn May 07 '11 at 17:51

score 1 · Answer 2 · edited Apr 13 '17 at 12:14

1

It's a Good Thing(TM) to have a daemon run on a dedicated unprivileged account. If the daemon ever gets exploited or turn rogue because of some bug, the damage will be limited to areas writeable by that user.

For discussion on placement of web root directory also take a look at /home/vhosts/ or /var/www/

edited Apr 13 '17 at 12:14

Community

1

answered May 07 '11 at 17:49

Paweł Brodacki

6,511
20
23

score 0 · Answer 3 · answered Jul 15 '12 at 19:14

Another reason for separation especially in Nginx auto installers like http://centminmod.com/ is that /home directory usually is the larger partitioned segment than /usr. And authors of such scripts don't know how end users partition their drives, they can't assume /usr has adequate disk free space. 99% of the time /home has the larger disk free space.

Conventional nginx Installation

3 Answers3