Securing Django deployment on Ubuntu server

Question

I am just starting out with Django and want to deploy a test application on a Linux VPS that I have. I am not familiar with how I can secure the deployment. If I configure Apache to serve the application from my projects directory under /home then I believe there is scope that someone with malicious intent might access my entire /home.

I was thinking of creating another user. Is there a better option?

Thanks Hari

Answer 1

Django projects are not meant to be put in the document root. Put it under /srv and point WSGIScriptAlias accordingly.

Answer 2

The best security practice for Django deployment is to use one user for each "site", this is easy to do with mod_wsgi, for each virtual host, you have something like this : :

<IfModule mod_wsgi.c>
    WSGIDaemonProcess mydeploygroup user=_myuser group=_mygroup threads=25
    WSGIProcessGroup mydeploygroup
    WSGIScriptAlias / /srv/vhosts/www.example.org/apps/myapp/wsgi/deployment.wsgi
</IfModule>

This is a good practice to have your .py files into a read-only location accessible only from this specific user. That way, if an attacker is able to upload arbitrary files, permissions prevent him from modifying existing Python code and backdoor it.

There is also a chroot feature but I have never tested it. Does anyone have a feedback?

Answer 3

You don't really need anything at all under DocumentRoot. Your WSGIScriptAlias should point at the wsgi-file, which can be anywhere the user www-data can read from. The wsgi-file in turn points at your Django-project, which can also be anywhere www-data can read from.

There doesn't seem to be any official rules on how to set up your structure. Personally I have all my projects in subfolders to /var/www.

Answer 4

If you don't need the whole internet to access you application, think about add some firewall rules to restrict access to the application.