Hello,

I don't quite understand how this works. Until now I was
running my websites under Cherokee Web Server. Cherokee ran under user
www-data and all my websites shared the same permissions
(www-data:www-data rwxrwx---). That worked well, but then I also
realised: If someone would be able to inject php code into one of my
websites, he would have full read/write acces to all of my sites. That
would enable him to read my database passwords. For example using this
line of code: `scandir("/usr/local/var/www/site2/config/database.php")`.

Now, I said goodbye to Cherokee and am currently looking into nginx.

The first thing I did was to restrict the permissions in the www folder:

> drwxr-x--- 4 root      root      4.0K Aug 16 14:30 .
> drwxr-sr-x 7 root      staff     4.0K Aug 15 15:02 ..
> drwx------ 2 www-site1 www-site1 4.0K Aug 25 20:44 site1
> drwx------ 9 www-site2 www-site2 4.0K Aug 15 15:38 site2


Then
I realised, that I cannot spawn workers per server block. So as far as I
understand, the user under which nginx is running (www-data) needs read
access to folder site1 and site2. So I would need to change the
permissions to


> drwxr-x--- 4 root      root      4.0K Aug 16 14:30 .
> drwxr-sr-x 7 root      staff     4.0K Aug 15 15:02 ..
> drwxr-xr-x 2 www-site1 www-data  4.0K Aug 25 20:44 site1
> drwxr-xr-x 9 www-site2 www-data  4.0K Aug 15 15:38 site2


That
is really bad because I would have the same security problem as I had
before with cherokee. With one line of php he could read from any "site"
folder (see above). I could tackle that problem by assigning rwx------
permissions to all files, but then I would probably be busier with
changing file permissions that developing websites ...




->
Is there no way to have workers spawn per server block that run under a
specific user? Say, 5 server blocks, 3 workers each?

-> How did you solve this problem?




Cheers
Stadtpirat

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx