Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to setup a production server, should I create a separate user to run certain application under similar to what apache does? Is it unsafe for them to run as root?

OS: Ubuntu 9.10

The server is for web based applications, It hosts a website but as alot of backed server process's as well

share|improve this question
1  
Which operating system are you using and what type of production server are you creating? –  Chris Jan 15 '10 at 21:51
add comment

4 Answers

up vote 3 down vote accepted

I prefer to have each application service run as its own user in order to have as much isolation between them as possible. If any part of the system gets broken or compromised I'd like to localise the damage as much as possible.

share|improve this answer
add comment

Root is the magic button. As little as possible should run as root.

For the rest, is this a dedicated server? That is, how many applications is it running? Just one, pick any user. Even run it as the web user.

You can basically think of a user as a boundary. If everything runs as the same user (say, www) then all those things have direct access to one another. Should one be compromised, it is all open.

However, for many uses, it doesn't matter. Don't take this wrong, but you don't seem to be a security expert, and so I have a feeling should someone get any access to your machine, it's all over anyway. It takes a dedicated effort to harden a machine against a dedicated attacker.

You didn't mention what language your web application is written in btw. If Ruby on Rails, each application can easily be its own user. If PHP, well, probably not. Probably run those as the web user.

share|improve this answer
    
Ha, no offense taken. I would definitely not call myself a security expert. The web app itself is written in django –  whatWhat Jan 15 '10 at 22:09
    
PHP can run quite happily as different users, it's just mod_php that makes it look hard. –  womble Jan 15 '10 at 23:06
    
Have a look at mod_suphp as a replacement for mod_php in Apache. –  rodjek Jan 16 '10 at 13:34
add comment

whatWhat I have each of my django instance running as separate user. This is the best way to do it. I am using Apache + WSGI Daemon process. I had earlier ran all the instances with the same user. But we had randomly faced few problems. As part of fine tuning many things I followed separating the users for each instance. Since then I am not having any problems for the past 8 months.
Like John mentioned anyways if one of your instances get compromised then all the other instances does not have to bother.

share|improve this answer
add comment

It is definitely ill advised to run a Python web application as root. If a specific part of the code must run as root, then you would be better off factoring that out into a separate backend service which the main web application communicates with using some interprocess communications process. That back end application should only accept connections from the host the web application runs on and not arbitrary connections from any host.

Besides that, you don't say how you are hosting Django so becomes harder to advise you if you are also after the method to isolate code to run as a specific user. Are you using mod_python, mod_wsgi, fastcgi or proxying to a backend Python WSGI server which is running it?

In worst case your only choice will be for code to run as same user that Apache runs as. This isn't advised if running other applications on same Apache, whether that be Python, PHP or some other language. This is because all the applications can interfere with each other and so a breach in a separate application can still cause you problems.

As such, running individual applications as distinct users and locking down file systems permissions such that each can only access the data for that application is preferable.

If you want an extra level of paranoia then you start looking at running individual applications in a chroot environment.

What exactly you can do is dictated by how you are hosting it, thus why important to know that.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.