CentOS LNMP 权限管理实操指南
一 核心原则
二 用户与运行身份
sudo adduser -r -s /sbin/nologin webusersudo chown -R webuser:webuser /var/www/htmluser nginx;(或统一改为 webuser 以便与 PHP-FPM 一致)sudo systemctl restart nginxuser = webuser、group = webuserlisten.owner = nginx、listen.group = nginx、listen.mode = 0660sudo systemctl restart php-fpmsudo chown -R mysql:mysql /var/lib/mysql三 文件与目录权限落地
find /var/www/html -type d -exec chmod 750 {} \;find /var/www/html -type f -exec chmod 640 {} \;sudo chown -R webuser:webuser /var/www/htmlchmod 750 /var/www/html/uploadschown webuser:webuser /var/www/html/uploadschmod 600 /path/to/configchmod 600 且仅 root 可访问setfacl -R -m u:deploy:rX /var/www/htmlgetfacl /var/www/html四 数据库与网络权限
mysql -u root -pCREATE USER 'webuser'@'localhost' IDENTIFIED BY 'StrongPass!';GRANT SELECT, INSERT, UPDATE, DELETE ON appdb.* TO 'webuser'@'localhost';FLUSH PRIVILEGES;bind-address = 127.0.0.1(如需远程仅对受控网段开放)sudo firewall-cmd --permanent --zone=internal --add-port=3306/tcp && sudo firewall-cmd --reloadsudo mysql_secure_installation 完成 root 强口令、匿名用户移除、测试库删除与远程 root 禁用五 SELinux 与防火墙
sestatussudo semanage fcontext -a -t httpd_sys_content_t "/var/www/html(/.*)?"sudo restorecon -Rv /var/www/htmlsudo setsebool -P httpd_can_network_connect_db 1sudo setenforce 0(生产不建议)sudo firewall-cmd --permanent --zone=public --add-service=http --add-service=https && sudo firewall-cmd --reloadsudo firewall-cmd --permanent --zone=internal --add-port=3306/tcp && sudo firewall-cmd --reload