Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am just starting out with Django and want to deploy a test application on a Linux VPS that I have. I am not familiar with how I can secure the deployment. If I configure Apache to serve the application from my projects directory under /home then I believe there is scope that someone with malicious intent might access my entire /home.

I was thinking of creating another user. Is there a better option?

Thanks Hari

share|improve this question

migrated from superuser.com Jul 9 '10 at 0:44

This question came from our site for computer enthusiasts and power users.

4 Answers 4

Django projects are not meant to be put in the document root. Put it under /srv and point WSGIScriptAlias accordingly.

share|improve this answer

The best security practice for Django deployment is to use one user for each "site", this is easy to do with mod_wsgi, for each virtual host, you have something like this : :

<IfModule mod_wsgi.c>
    WSGIDaemonProcess mydeploygroup user=_myuser group=_mygroup threads=25
    WSGIProcessGroup mydeploygroup
    WSGIScriptAlias / /srv/vhosts/www.example.org/apps/myapp/wsgi/deployment.wsgi
</IfModule>

This is a good practice to have your .py files into a read-only location accessible only from this specific user. That way, if an attacker is able to upload arbitrary files, permissions prevent him from modifying existing Python code and backdoor it.

There is also a chroot feature but I have never tested it. Does anyone have a feedback?

share|improve this answer

You don't really need anything at all under DocumentRoot. Your WSGIScriptAlias should point at the wsgi-file, which can be anywhere the user www-data can read from. The wsgi-file in turn points at your Django-project, which can also be anywhere www-data can read from.

There doesn't seem to be any official rules on how to set up your structure. Personally I have all my projects in subfolders to /var/www.

share|improve this answer

If you don't need the whole internet to access you application, think about add some firewall rules to restrict access to the application.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.