216

I am using the default config while adding the specific directory with nginx installed on my ubuntu 12.04 machine.

server {
        #listen   80; ## listen for ipv4; this line is default and implied
        #listen   [::]:80 default ipv6only=on; ## listen for ipv6

        index index.html index.htm;

        # Make site accessible from http://localhost/
        server_name localhost;

        location / {
                # First attempt to serve request as file, then
                # as directory, then fall back to index.html
                root /username/test/static;
                try_files $uri $uri/ /index.html;
                # Uncomment to enable naxsi on this location
                # include /etc/nginx/naxsi.rules
        }
...

...
}

I just want a simple static nginx server to serve files out of that directory. However, checking the error.log I see

2014/09/10 16:55:16 [crit] 10808#0: *2 stat() "/username/test/static/index.html" failed (13: Permission denied), client:, server: localhost, request: "GET /favicon.ico HTTP/1.1", host: "domain"
2014/09/10 16:55:16 [error] 10808#0: *2 rewrite or internal redirection cycle while internally redirecting to "/index.html

I've already done chown -R www-data:www-data on /username/test/static, I've set them to chmod 755. I don't know what else needs to be set.

3
  • 8
    Check if the www-data user can cd to the /username/test/static directory: sudo -u www-data cd /username/test/static
    – Maciej Sz
    Commented Sep 10, 2014 at 21:17
  • 1
    I am getting permission denied , but when i do ls -l it shows that its set to www-data user
    – user299709
    Commented Sep 10, 2014 at 21:57
  • 2
    Could it be that /username is on encryptfs? I am having exactly the same issues with /home/username folder, where my site is located. If I move it out of encryptfs then all works fine. Still no solution for me...
    – Georgi
    Commented Mar 27, 2015 at 21:49

18 Answers 18

370

Nginx operates within the directory, so if you can't cd to that directory from the nginx user then it will fail (as does the stat command in your log). Make sure the www-user can cd all the way to the /username/test/static. You can confirm that the stat will fail or succeed by running

sudo -u www-data stat /username/test/static

In your case probably the /username directory is the issue here. Usually www-data does not have permissions to cd to other users home directories.

The best solution in that case would be to add www-data to username group:

gpasswd -a www-data username

and make sure that username group can enter all directories along the path:

chmod g+x /username && chmod g+x /username/test && chmod g+x /username/test/static

For your changes to work, restart nginx

nginx -s reload
12
  • 2
    @ElgsQianChen keep in mind that this is OS level permission system, so in POSIX systems it depends on your umask. If you need a more generic solution, that doesn't require chmoding every new directory, then there is a solution. It requires reverse group association (username to www-data group) and the use of setgid. Feel free to post a new question for more elaborate description and I'll be happy to answer.
    – Maciej Sz
    Commented Apr 27, 2015 at 12:16
  • 1
    What if my path is in /root/ directory? Is it safe to do chmod g+x on /root ? And adding www-data to root group ? Commented May 24, 2016 at 5:59
  • 5
    Well my nginx user can able to access my website directory but still it says permission denied on the error logs. Commented Nov 9, 2016 at 9:27
  • 3
    omg thank you thank you.! gpasswd -a www-data username was the answer. Commented Jan 22, 2017 at 7:26
  • 2
    Security-wise, is adding www-data to the username group considered to be safe?
    – Farzan
    Commented Nov 4, 2022 at 1:11
243

Nginx need to have +x access on all directories leading to the site's root directory.

Ensure you have +x on all of the directories in the path leading to the site's root. For example, if the site root is /home/username/siteroot:

chmod +x /home/
chmod +x /home/username
chmod +x /home/username/siteroot
6
  • 5
    thank you Krish!! It works and with a clean explanation
    – Ninja
    Commented Feb 28, 2023 at 16:48
  • 4
    I have already double checked everything but no success! This was what I missed. Commented Mar 15, 2023 at 3:53
  • 2
    This is the right answer, because this answer explains the root of the problem! Needed (+x access) but not (+r access) as expected by default. Commented Mar 16, 2023 at 16:57
  • 1
    Thank you. After everything I tried. This solved the issue for me. Commented Sep 20, 2023 at 3:46
  • 2
    Not sure how I've never ran into this before. This is what I needed after fighting permission denied errors for a few hours. Thank you!
    – spencer.sm
    Commented Mar 2 at 22:22
124

I've just had the same problem on a CentOS 7 box.

Seems I'd hit selinux. Putting selinux into permissive mode (setenforce permissive) has worked round the problem for now. I'll try and get back with a proper fix.

10
  • 6
    This is the exact "not documented" behavior I was trying to understand for these last 3 days...
    – Achilles
    Commented Jun 20, 2015 at 8:49
  • 3
    Here is a post about this behavior: axilleas.me/en/blog/2013/…
    – Achilles
    Commented Jun 20, 2015 at 8:57
  • 6
    So, I found myself back here... This time I find I copied the file in question from my home directory to the html directory, and updated the ownership. Same issue as 2015... Better fix: ls -Z myFile.js will show the SELinux context: -rw-r--r--. nginx nginx unconfined_u:object_r:user_home_t:s0 myFile.js Use chcon -v --type=httpd_sys_content_t myFile to change the SELinux content. Commented Jan 29, 2018 at 14:32
  • 8
    Yup; I had the same issue. sudo setenforce 0 fixed it for me. Commented Nov 10, 2018 at 20:13
  • 1
    Just a note, if you want selinux completely disabled, you'll need to change the SELINUX value to disabled in /etc/selinux/config, followed by a reboot. When it's set to permissive, it can still run checks behind the scenes (using valuable CPU), but take no action. Commented Dec 28, 2019 at 20:19
40

On CentOS 7.0 I had this Access Deined problem caused by SELinux and these steps resolved the issue:

yum install -y policycoreutils-devel
grep nginx /var/log/audit/audit.log | audit2allow -M nginx
semodule -i nginx.pp

Update: Just a side-note from what I've learned while using digitalocean's virtual Linux servers, or as they call them Droplets. Using SELinux requires a decent amount of RAM. It's most probably like you won't be able to run and manage SELinux on a droplet with less than 2GB of RAM.

2
  • 2
    Thanks very much for this. It did solve my problem (also on CentOS 7) to begin with, but then I was blocked by a second denial elsewhere, so resorted to setenforce 0. However, when looking back at what this solution actually does, I realised that I needed to re-run the commands to update the permissions for the nginx user. That seemed to work and I could set SELinux back to enforcing.
    – danj1974
    Commented Aug 21, 2015 at 10:57
  • Well, this may be a bit too late. Still, it's worth mentioning that when you keep SELinux enforcing; it is imperative to remember, software like Nginx insert their own set of rules like default ports, default paths, read/write access to paths, etc. into SELinux. If you don't want any trouble, you must follow those rules (like putting your HTML/PHP files into /var/www) or else prepare to overcome problems originating deep in the SELinux context. This can be helpful [CentOS < 8]: getpagespeed.com/server-setup/nginx/nginx-selinux-configuration
    – Achilles
    Commented Jan 8, 2020 at 9:06
38

You may have Security-Enhanced Linux running, so add rule for that. I had permission 13 errors, even though permissions were set and user existed..

chcon -Rt httpd_sys_content_t /username/test/static

2
  • Thanks! Worked on CentOS release 6.10 (Final).
    – marw
    Commented Jul 10, 2018 at 14:30
  • 1
    Worked on CentOS 7.5.1804 (Core).
    – Niek
    Commented Oct 16, 2018 at 8:15
35

To check the default Nginx users:

sudo ps aux| grep nginx

You will get an output like this:

root       69558  0.0  0.0  66276  1708 ?        Ss   10:14   0:00 
nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
www-data   69559  0.0  0.1  66516  5540 ?        S    10:14   0:00 nginx: worker process
www-data   69560  0.0  0.1  66516  6944 ?        S    10:14   0:00 nginx: worker process
root       69794  0.0  0.0   8168   672 pts/1    S+   10:19   0:00 grep --color=auto nginx

Also, check the nginx.conf file using any text editor of your choice: I will be using vim:

vim /etc/nginx/nginx.conf

enter image description here

Solution:

  1. Change the www-data user in the nginx.conf file to root, in case you are on root user. enter image description here
  1. The Second solution is to add the user www-data to root group.
8
  • 2
    after over 10hrs of searching, this was what worked for me, thanks Commented Jan 20, 2022 at 0:04
  • 3
    Is it a safe action? Can I use it in the production envitonment? Commented Aug 12, 2022 at 12:09
  • 3
    It depends on a lot of things, but for security reasons I would use the second approach instead. Making nginx root is not a good idea.
    – Boanerges
    Commented Aug 13, 2022 at 18:10
  • 1
    Thanks a lot, After digging deep. your answer helped me. Commented Apr 28, 2023 at 5:31
  • 1
    Finally, after days of struggling with this, fixing file & folder permissions, incl. SELinux ones, this is the only thing that worked on my docker+nginx mounted volume setup. Commented Aug 17, 2023 at 8:07
18

This is how i fixed this

sudo chmod o+x /home/ec2-user
7
  • 1
    This worked for me. But more explaination of the issue would have been best. Commented Nov 16, 2021 at 20:00
  • 1
    This is the only thing that worked for me. I kept getting "chmod: changing permissions of '/home/': Operation not permitted" when trying the answers from above. Big thanks.
    – Nunchuk
    Commented Dec 4, 2022 at 3:53
  • 1
    my nginx user could not change directory to required destination. above command worked for me. Commented Jan 9, 2023 at 15:52
  • 1
    This worked and intuitively we could say the accepted answer of setting the proxy server as root would be a big risk and here is a discussion on that - serverfault.com/a/1010924
    – Kai Durai
    Commented Sep 17, 2023 at 0:13
  • 1
    Spent a whole day trying to fix this and no AI helped me lol. This worked. Thanks! Replace ec2-user with your appropriate username.
    – M.Ed
    Commented Nov 10, 2023 at 13:05
8

I finally found my way through. In short, let's say your username is joe and you hold a website under your personal filesystem /home/joe/path/to/website.

You literally have to tell the system that nginx is your pal.
Place nginx in joe group :

sudo gpasswd -a nginx joe

After that if it still doesn't work, check right access of /home/joe directory. That's probably the reason why nginx can't reach the file because even if he is your friend now you have to open him the door to your house :

sudo chmod g+x /home/joe

That's it. That's literally all you have to do to give nginx access to your local files :)

I don't think there are security concerns with this method because nginx is the high authority and only an admin can change the group. nginx can now read what's in joe directories. It's only a security breach if the holder of the nginx account is different with the user you open directory access from, but in my case I'm the holder of both parties, that is in a local context.

1
  • Changing home folder to executable (chmod g+x) works in my case. Commented Oct 3, 2020 at 11:11
4

Symptom:

Could not upload images to WordPress Media Library.

Cause:

(CentOS) yum update

Error:

2014/10/22 18:08:50 [crit] 23286#0: *5332 open() "/var/lib/nginx/tmp/client_body/0000000003" failed (13: Permission denied), client: 1.2.3.4, server: _, request: "POST /wp-admin/media-new.php HTTP/1.1", host: "example.com", referrer: "http://example/wp-admin/media-new.php"

Solution:

chown -R www-data:www-data /var/lib/nginx

4

I faced this problem, I solved it to give permissions to nginx user and group something like this:

chown -R nginx:nginx /username/test/static
1
  • 1
    actually worked, notice that if you are running nginx in docker container and your nginx.conf file starts with user nginx; so in your dockerfile you should have copy ./nginx.conf /etc/nginx/nginx.conf RUN chown -R nginx:nginx /usr/share/nginx/html/ to give your user the write privilege
    – Amr
    Commented Jan 15, 2021 at 13:55
3

Change your nginx.conf user property to www-static files owener.

#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user your_user_name;

# same other config
2

By default the static data, when you install the nginx, will be in /var/www/html. So you can just copy your static folder into /var/html/ and set the

root /var/www/<your static folder>

in ngix.conf (or /etc/nginx/sites-available/default)

This worked for me on ubuntu but I guess it should not be much different for other distros.

Hope it helps.

2

In my case, the folder which served the files was a symbolic link to another folder, made with

ln -sf /origin /var/www/destination

Even though the permissions (user and group) where correct on the destination folder (the symbolic link), I still had the error because Nginx needed to have permissions to the origin folder whole's hierarchy as well.

1

I had the same issue, I am using Plesk Onyx 17 with Centos7. I could see this error in proxy_error_log under the affected domain's logs. All the dirs/files in /var/www/vhosts/ are owned by respective users (domain owners) and you can see that all of them are in psacln group. So solution was to add nginx also to this group, so he can see what he needs:

usermod -aG psacln nginx

And indeed, restart nginx and reload page with Ctrl+F5.

1
  • Restarting nginx was the point I was missing all the time
    – chris_cm
    Commented Aug 2 at 14:15
0

This is usually the privilege problem... For me, its because i use the /root/** as the nginx root, it need higher privilege. An easy way is just move the project into a directory created by yourself.

-1

I found a work around: Moved the folder to nginx configuration folder, in my case "/etc/nginx/my-web-app". And then changed the permissions to root user "sudo chown -R root:root "my-web-app".

-2
  1. sudo nano /etc/nginx/nginx.conf
  2. change user from: user www-data; to: user root;
  3. restart nginx
1
  • Do not start Nginx as root or regular user, this is a critical security flaw !!! Commented Jan 21 at 0:48
-5

You can also add which user will run the nginx. In the nginx.conf file, make the following changes:

user root;

You can add the above line as the first line in your nginx conf. You can write the name of any user who has the permission to write in that directory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.