16

In general, when should one create a new user account to run a piece of internet-facing software on a server?

For instance, suppose I'm using a shared Debian server (e.g. via Dreamhost) and I want to run some websites using WordPress, some using Redmine, some using Ruby on Rails, maybe some using Django, and I'd like to serve Mercurial repositories too.

On Dreamhost servers and many other similarly set-up servers, this could all be done under a single user account, but I can see some drawbacks to that approach:

  • A lengthier .bashrc
  • If that one account becomes compromised, so do all the sites running under it.

On the other hand, having lots of user accounts could become a bit of a pain to keep track of, especially if some of them have identical requirements in terms of installed software. For instance, having one account for each website running WordPress might be overkill.

What's the best practice? Is it simply a question of reducing the number of hosted sites (or hosted repositories, etc) per user account proportionately to one's level of paranoia?

Please post your opinions on this, giving your reasons for them.

Also, if you have any reasons for thinking that the approach taken on a private server or VPS should differ from the approach taken on a shared server, please outline what they are and, again, your reasons for them.

2 Answers 2

10

I am generally a fan of "One user for anything that opens listening socket on the network" -- One for Apache, one for Mail, one for DNS, etc.

This is (as last I heard) still Best Current Practice, and the reason behind this is plain and simple paranoia: These services are exposed to the Big Bad Internet, if someone finds a vulnerability and exploits it before I have a chance to patch the software at least I'm confining them to one user account, with only the privileges required to run the single service it's responsible for.
Generally speaking I consider this level of isolation to be sufficient to protect the system, though each application is an island of vulnerability (for example if someone installs a vulnerable WordPress plugin all the things Apache has access to (i.e. all the websites) are effectively vulnerable in the event of a compromise.

An extended version of that argument can thus be made for sandboxing Shared Hosting clients' websites with its own Apache configuration and user (you don't necessarily have to install a full web stack for each site, just a separate apache configuration specifying a different user), the downside being that each site is now running a bunch of Apache processes, so your RAM usage just went up substantially, and things that are world-readable are still vulnerable if any single Apache instance/user gets compromised.

Extending further the argument for putting each Apache in a chroot (or jail if you on BSD systems) can be made for even more security, but now you're talking about additional disk space since each chroot/jail will need all the software required to run the site it contains (and the need to update this software for every site rather than just one master copy on the server when patches come out), plus the RAM requirement just like when you had separate users/apache instances.
This mitigates everything except an OS/Kernel bug that lets users break out of the chroot (which becomes the argument for running every site on a separate physical server - which then becomes the argment for separating the sites into different vlans/subnets, etc.)


As with all risks, you can't eliminate it: you can only mitigate it down to an acceptable level based on the potential harm/cost of a compromise, the likelihood of a compromise, and the cost of each level of mitigation.
For my money, for a non-critical, non E-Commerce shared hosting environment the basic "One user for Apache, one for DNS, one for mail, etc." safety net is enough. If there's a need for security beyond that level your users should be seriously considering their own hardware.

7
  • 1
    There's also a module for Apache (mod_su I think?) that lets Apache change the user it's running under dynamically based on the incoming request; in a shared hosting environment, you'd set it to change to the user owning the site being accessed. This provides compartmentalization of the most common types of breaches (code injection, etc.) so that only the one user who e.g. installed the bad WordPress plugin is affected by it. It also offers some protection against a full breach of the Apache process itself, and against privilege escalation attacks, but admittedly that's not its real purpose.
    – Kromey
    Apr 12, 2011 at 17:02
  • @Kromey, I couldn't find much information about mod_su. Do you mean mod_suexec?
    – user61015
    Apr 12, 2011 at 17:18
  • 1
    @sampablokuper Yup, that would be the one, sorry for the misinformation.
    – Kromey
    Apr 12, 2011 at 17:19
  • 1
    @Kromey the big problem with mod_suexec is that "Non-CGI requests are still processes with the user specified in the User directive" - so if PHP is a module it's still running as the "main" apache user. It's a great solution if everything you're executing is CGI though.
    – voretaq7
    Apr 12, 2011 at 17:21
  • @voretaq Ah, I wasn't aware of that limitation. Still, could be useful in some environments, but that does indeed make it less applicable than I had thought it was.
    – Kromey
    Apr 12, 2011 at 17:40
6

Generally what I do is have one user for external facing services that is not allowed to login ("nobody" for example), and one account that is allowed login and su or sudo. Naturally make sure your usernames are different and not easily guessable.

I don't see having one user per service as necessary unless you are running a shared hosting environment where each customer has a login. If you realistically see yourself as a very attractive target for hacking, you may as well isolate as much as possible. However, unless you are doing something very controversial or hosting financial data you aren't really that attractive of a target.

1
  • +1 the level of separation needs to be appropriate to the situation at hand -- and typically once you get to "very controversial" or "financial data" you're going to want my own damn machine levels of separation :-)
    – voretaq7
    Apr 12, 2011 at 16:35

You must log in to answer this question.