3 ms·
> echo “deb http://nginx.org/packages/ubuntu/ http://nginx.org/packages/ubuntu/ lucid nginx” >> /etc/apt/sources.list Shouldn't that be "oneiric" since you're
by kijin 15y ago
> echo “deb http://nginx.org/packages/ubuntu/ http://nginx.org/packages/ubuntu/ lucid nginx” >> /etc/apt/sources.list
Shouldn't that be "oneiric" since you're using Ubuntu 11.10? Or does the nginx team compile everything statically so it works no matter which version you choose?
I'm also a bit puzzled with your decision to make PHP run as the "nginx" user. You probably did this to match the username that the nginx debs use (Ubuntu's default package uses www-data), but what's the benefit of matching users there? If you're going to change it anyway, why not make PHP run as "php", for example? Some might even say that running both PHP and nginx under the same user reduces security.
- shuzchen 15y agoIf you've got your php code and static assets in the same repo, then it's generally easiest to have php and nginx run as the same user that owns the files in that repo. php needs access to those file to parse/run them, and nginx needs access to those (static) files to serve them. Of course, you can manage this in other, more security conscious ways (move static assets elsewhere, use group permissions, etc.) but this is probably the simplest.
- kijin 15y agoMost files and directories have 644/755 permissions by default, which means they can be owned by any user and still be accessible (readable) to any other user on the same system. What really matters is who can write to those files and directories, and there's no reason for anything other than "wp-content" to be writable by the web server. WordPress blogs get exploited all the time, so a bit of paranoia can't hurt.