Based on the answer from @Ryan Ahearn, following is what I did on Ubuntu 16.04 to create a user front that only has permission for nginx's web dir /var/www/html.
Steps:
* pre-steps:
* basic prepare of server,
* create user 'dev'
which will be the owner of "/var/www/html",
*
* install nginx,
*
*
* create user 'front'
sudo useradd -d /home/front -s /bin/bash front
sudo passwd front
# create home folder, if not exists yet,
sudo mkdir /home/front
# set owner of new home folder,
sudo chown -R front:front /home/front
# switch to user,
su - front
# copy .bashrc, if not exists yet,
cp /etc/skel/.bashrc ~front/
cp /etc/skel/.profile ~front/
# enable color,
vi ~front/.bashrc
# uncomment the line start with "force_color_prompt",
# exit user
exit
*
* add to group 'dev',
sudo usermod -a -G dev front
* change owner of web dir,
sudo chown -R dev:dev /var/www
* change permission of web dir,
chmod 775 $(find /var/www/html -type d)
chmod 664 $(find /var/www/html -type f)
*
* re-login as 'front'
to make group take effect,
*
* test
*
* ok
*