I have apache-mpm-itk + php_module setup and user's folders/files belongs to them. But I want to migrate several accounts to nginx + php-fpm.

What should be the right permissions on folders/files if I want to use nginx/php-fpm with virtual hosts which belongs to different users?

For example, user's home:


and permissions is user:user

Here is code from host's nginx conf:

server {
    listen 8080;
    server_name domain.com;
    root /var/www/user/data/www/domain.com/;

    index index.php index.html index.htm;

    location / {
            # First attempt to serve request as file
            try_files $uri $uri/index.php;

    location ~ \.php$ {
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            fastcgi_pass unix:/var/run/php5-fpm/domain.com.socket;
            fastcgi_index index.php;
            include fastcgi_params;

And here is pool config from php-fpm:


listen = /var/run/php5-fpm/domain.com.socket
listen.backlog = -1
listen.owner = user
listen.group = user

; Unix user/group of processes
user = user
group = user

; Choose how the process manager will control the number of child processes.
pm = dynamic
pm.max_children = 75
pm.start_servers = 10
pm.min_spare_servers = 5
pm.max_spare_servers = 20
pm.max_requests = 500

; Pass environment variables
env[PATH] = /usr/local/bin:/usr/bin:/bin
env[TMP] = /var/www/user/data/tmp
env[TMPDIR] = /var/www/user/data/tmp
env[TEMP] = /var/www/user/data/tmp

; host-specific php ini settings here
; php_admin_value[open_basedir] = /var/www/user/data:/tmp
php_admin_value[error_log] = /var/user/data/logs/fpm-php.log
php_admin_value[realpath_cache_size] = 4096K    

nginx workers are spawned with the value from the user directive. The default value is nobody, but nginx official packages include a default configuration containing user nginx; in nginx.conf, in the main context.

When only a user is specified, the group with the same name is applied to nginx workers.

Default user:group for PHP-FPM is www-data:www-data.

What you could so is making files owned by nginx:www-data which would work out the box. The problem would then be to update files, since any user creating files would need write access.

By default, directories are writeable by its owner (user) but not this user's group, which forces you to either:

  1. use the nginx user to update Web content
  2. add the write access to the www-data group and add the user managing content to this group

To me, both previous solutions are less-than-ideal.

What I would do is making that directory tree owned by the user managing content, use user nginx www-data; to make nginx workers user belonging to the www-data group, and allow the user to read/write, group to read and others nothing (thus a 0640 bitmask for files and 0750 bitmask for directories, allowing traversal for user and group).

To go even further, I would add the setgid bit on directories, to ensure the right group is automatically applied to any directory/file created in the tree. I would thus use the 2640 bitmask on files and 2750 on directories.

You can change the default bitmask for a specific partition at the OS level... or you can stick with the defaults which are a bit less restrictive, but work flawlessly, simply changing ownership and adding the setgid flag.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.