23 Nginx全局块的user指令

23.1 user指令

　　user 用于配置运行Nginx服务器的worker进程的用户和用户组

语法	user user [group]
默认值	nobody
位置	全局块

　　该属性也可以在编译时指定，语法：./configure --user=USER --group=GROUP，如果同时在编译时设定又在配置文件中指定，最终将以配置文件中的为准

23.2 案例

1.设置一个用户信息 www

[root@nginx-100 ~]# head -2 /usr/local/nginx/conf/nginx.conf
#user  nobody;
user  www;

2.检查配置文件

[root@nginx-100 ~]# /usr/local/nginx/sbin/nginx -t
nginx: [emerg] getpwnam("www") failed in /usr/local/nginx/conf/nginx.conf:2
nginx: configuration file /usr/local/nginx/conf/nginx.conf test failed

3.创建用户并热加载

[root@nginx-100 ~/nginx/core/nginx-1.16.1]# ps -ef|grep nginx
root       1700      1  0 16:38 ?        00:00:00 nginx: master process /usr/local/nginx/sbin/nginx
nobody     1701   1700  0 16:38 ?        00:00:00 nginx: worker process
root       1783   1451  0 18:50 pts/0    00:00:00 grep --color=auto nginx
[root@nginx-100 ~]# useradd www
[root@nginx-100 ~]# /usr/local/nginx/sbin/nginx -t && /usr/local/nginx/sbin/nginx -s reload
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
[root@nginx-100 ~]# ps -ef|grep nginx
root       1700      1  0 16:38 ?        00:00:00 nginx: master process /usr/local/nginx/sbin/nginx
www        1841   1700  0 18:57 ?        00:00:00 nginx: worker process
root       1843   1451  0 18:57 pts/0    00:00:00 grep --color=auto nginx

4.创建 /root/html/index.html 页面

[root@nginx-100 ~]# mkdir -p /root/html/
[root@nginx-100 ~]# cat /root/html/index.html 
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
<p><em>I am WWW</em></p>
</body>
</html>

5.修改 nginx.conf

[root@nginx-100 ~]# cat /usr/local/nginx/conf/nginx.conf
..........
        location / {
            root   /root/html;
            index  index.html index.htm;
        }
.........
[root@nginx-100 ~]# /usr/local/nginx/sbin/nginx -t && /usr/local/nginx/sbin/nginx -s reload
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

6.浏览器访问
浏览器访问：http://10.0.0.100/ 返回 403 状态码

7.重新修改文件路径和修改 nginx.conf

[root@nginx-100 ~]# cp -r /root/html /home/www/
[root@nginx-100 ~]# cat /usr/local/nginx/conf/nginx.conf
..........
        location / {
            root   /home/www;
            index  index.html index.htm;
        }
..........
[root@nginx-100 ~]# /usr/local/nginx/sbin/nginx -t && /usr/local/nginx/sbin/nginx -s reload
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful

8.浏览器再次访问
浏览器访问：http://10.0.0.100/ 正常

9.原因分析

[root@nginx-100 ~]# cd /root/
[root@nginx-100 ~]# ls -ltr
total 4
-rw-------. 1 root root 1495 Feb  5  2025 anaconda-ks.cfg
drwxr-xr-x  3 root root   18 Mar 10 23:13 nginx
drwxr-xr-x  2 root root   24 Mar 30 19:04 html
[root@nginx-100 ~]# cd /home/
[root@nginx-100 /home]# ls -ltr
total 0
drwx------ 3 www www 92 Mar 30 19:30 www

nginx 子进程 worker process的启动用户 www，当前用户没有访问 /root/html 目录的权限

10.结论

综上，使用 user 指令可以指定启动运行工作进程的用户及用户组，系统权限的访问控制将更加精细，也更加安全（工作进程设置的用户只能打开对应有权限的文件或目录）

———————————————————————————————————————————————————————————————————————————

无敌小马爱学习

posted on 2026-03-25 11:14 马俊南阅读(6) 评论(0) 收藏举报