I'm attempting to understand some concepts surrounding security and environment variables for a web application running under Apache on Ubuntu 10.04 Server.
I have a few applications that I would like to run as a user that has no shell or password (I understand that this is a good idea, but I'm no expert). One of the applications is a web app that is started via a system init script, the others are utilities started on an ad-hoc basis from the commandline via
sudo with the
Each application needs access to the same set of environment variables. I can modify the script that starts each application, and set the environment variables there, but I would prefer it if the environment variables were somehow set for the user under which the application is run.
My questions are:
Is that possible to set 'per user' environment variables for a user that has no shell? I've read "Setting environment variables for a service without a login shell on Debian", but the given solution is essentially the same as modifying each of my application scripts.
If I cannot set the environment variables per user, what are the security risks associated with giving the user a shell?
What, if any, are the alternatives or recommendations for this presumably common situation?