# Securing nginx: Workers per server block under specific user? **URL:** \ **Category:** NGINX\ **Created:** [August 26, 2013, 1:15pm UTC](https://www.ruby-forum.com/t/securing-nginx-workers-per-server-block-under-specific-user/236317 "2013-08-26T13:15:04Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![addis\_a](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/c4cdca/32.png) [@addis\_a](https://www.ruby-forum.com/u/addis_a)\ **Post date:** [August 26, 2013, 1:15pm UTC](https://www.ruby-forum.com/t/securing-nginx-workers-per-server-block-under-specific-user/236317/1 "2013-08-26T13:15:04Z")
Hello, I don’t quite understand how this works. Until now I was running my websites under Cherokee Web Server. Cherokee ran under user www-data and all my websites shared the same permissions (www-data:www-data rwxrwx—). That worked well, but then I also realised: If someone would be able to inject php code into one of my websites, he would have full read/write acces to all of my sites. That would enable him to read my database passwords. For example using this line of code: `scandir("/usr/local/var/www/site2/config/database.php")`. Now, I said goodbye to Cherokee and am currently looking into nginx. The first thing I did was to restrict the permissions in the www folder: > drwxr-x— 4 root root 4.0K Aug 16 14:30 . > drwxr-sr-x 7 root staff 4.0K Aug 15 15:02 … > drwx------ 2 www-site1 www-site1 4.0K Aug 25 20:44 site1 > drwx------ 9 www-site2 www-site2 4.0K Aug 15 15:38 site2 Then I realised, that I cannot spawn workers per server block. So as far as I understand, the user under which nginx is running (www-data) needs read access to folder site1 and site2. So I would need to change the permissions to > drwxr-x— 4 root root 4.0K Aug 16 14:30 . > drwxr-sr-x 7 root staff 4.0K Aug 15 15:02 … > drwxr-xr-x 2 www-site1 www-data 4.0K Aug 25 20:44 site1 > drwxr-xr-x 9 www-site2 www-data 4.0K Aug 15 15:38 site2 That is really bad because I would have the same security problem as I had before with cherokee. With one line of php he could read from any “site” folder (see above). I could tackle that problem by assigning rwx------ permissions to all files, but then I would probably be busier with changing file permissions that developing websites … -\> Is there no way to have workers spawn per server block that run under a specific user? Say, 5 server blocks, 3 workers each? -\> How did you solve this problem? Cheers Stadtpirat ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [August 26, 2013, 1:24pm UTC](https://www.ruby-forum.com/t/securing-nginx-workers-per-server-block-under-specific-user/236317/2 "2013-08-26T13:24:25Z")
On Monday 26 August 2013 15:14:32 - - wrote: […] > That > is really bad because I would have the same security problem as I had > before with cherokee. With one line of php he could read from any “site” > folder (see above). I could tackle that problem by assigning rwx------ > permissions to all files, but then I would probably be busier with > changing file permissions that developing websites … Nginx doesn’t execute php, so what is the problem then? wbr, Valentin V. Bartenev ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [August 26, 2013, 1:30pm UTC](https://www.ruby-forum.com/t/securing-nginx-workers-per-server-block-under-specific-user/236317/3 "2013-08-26T13:30:51Z")
Am 26.08.2013 13:23, schrieb Valentin V. Bartenev: > Nginx doesn’t execute php, so what is the problem then? > > wbr, Valentin V. Bartenev Try to use php-fpm, there you can define pools with a specific username for each pool. Kind regards Alexander K. ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [September 2, 2013, 9:07am UTC](https://www.ruby-forum.com/t/securing-nginx-workers-per-server-block-under-specific-user/236317/4 "2013-09-02T09:07:02Z")
how do you execute your php? if you reverse proxying to an apache you might use suphp, as usual: [http://www.suphp.org/Home.html](http://www.suphp.org/Home.html) php-fpm has a similar option, as alex mentioned if you really need to define workers for each server, run an nginx-instance for each of your websites; you can define an own user for each instance. Posted at Nginx Forum: > **[Re: Securing nginx: Workers per server block under specific user?](https://forum.nginx.org/read.php?2,242209,242444#msg-242444)** > > Hello, I don't quite understand how this works. Until now I was running my websites under Cherokee Web Server. Cherokee ran under user www-data and all my websites shared the same permissions (www-data:www-data rwxrwx---). That worked well, but then...