Posted by superfedya on May 15, 2012 at 2:39am
Hi,
With apache Drupal has able to set the folder permissions. But with Nginx I must to do that manually,
Maybe because my Nginx/Group user is Nginx and folder's owner/group is Root?
Any suggestion?
Thanks
Comments
Do you mean that Drupal 7
Do you mean that Drupal 7 auto-update feature?
I'd consider it a security weakness if your webserver user is able to change permissions on things except the items inside the /files directory, which it needs to be able to delete.
Which folder do you mean?
what
I agree with brianmercer that generally the user that PHP runs as should not be able to write anywhere outside file storage, which should be owned by the user PHP runs as (for that site).
This isn't exactly a nginx issue either, it's a matter of the configuration of whatever PHP runtime you're using (I assume PHP-FPM).
PHP-FPM can be configured to run as any user(s) you'd like, so can have write access to the webroot exactly as mod-php would, or unlike mod-php can easily run as a user specific to the site (in the case of a shared-hosting-like setup where you should have per-site permissions).
What problem are you having exactly?
Which folder do you
/files
Yes, Im use PHP-FPM.
Drupal cannot write anything in /files folder if I didn't set chmod 777 to the folder (like imagecache and it's sub-folder) manually.
Thanks
No need
to set it to
777. The most you would need is775if you have a different group than that of the owner. The PHP scripts must be readable by the server owner.Usually Nginx runs under
www-dataon Debian based systems. It can run under other users but you need to useauthbindorsetcapto add those capabilities to the program.I'd check your php-fpm config. The problem is probably there.
Figure out the nginx user and
Figure out the nginx user and also the the php-fpm user. You can do:
ps aux | grep nginxand
ps aux | grep phpto discover them. You want the worker and pool processes and not the master processes which will likely be root.
On Debian/Ubuntu, the nginx user is set in your /etc/nginx/nginx.conf with a line like:
user www-data;and for php-fpm (on recent Debian) it is set in /etc/php5/fpm/pool.d/www.conf with lines like:
user = www-datagroup = www-data
Since your nginx user is "nginx" I assume you're using something other than Debian, but hopefully those will help you find the right files.
For the /sites/default/files folder your nginx user must be able to read the files there and the php-fpm user must be able to write the files there. On Debian, they both run as the same user, so you can give ownership and group to www-data and make the /files directory 770.
If your nginx and php-fpm user are going to be different then you can give ownership and group to the php-fpm user and make the files there 775 so that the nginx user can read the files. Or better, make the directory owner the php-fpm user and the directory group nginx and then do 750. Or you may wish to change the php-fpm and nginx user to be the same and then go 770.
I created a user www-data and
I created a user www-data and group www-data. Now us my Nginx and php-fpm user.
I make this user owner of the /var/www, /var/lib/php/session and /var/lib/cache/nginx.
Is that correct or it must be a owner of the /var?
Thanks