Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a security risk in running a web server like Unicorn as root?

The Nginx master process runs as root, the Nginx worker runs as the limited www-data user, but I can't set another user like www-data to run the Unicorn master/workers without messing around with www-data's PATH.

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

it is absolutely a security risk. It means that if someone were to exploit unicorn into doing something it shouldn't be doing, they get to have root permissions on your box instead of the extremely limited www-data permissions. You should be able to just modify the PATH in the scripts which start unicorn. In any case, modifying a PATH is certainly not as bad as your suggested alternative of running as root.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.