Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are running a web application in python using wsgi with apache2, and must submit to a penetration test. The testers will be exploring the potential for damage if the attackers gain shell access as the apache user.

Currently, the damage potential is enormous, as we have the credentials for the database, s3 service, etc. all stored in a text file readable by the apache user. This seems to be the default advice when setting up these sorts of applications, but is there a more secure way to do this?

I was thinking of using apache (as root) to pass environment variables with setenv to the wsgi app, but is this actually more secure? Any advice for this?


share|improve this question
You might want to try as well. – HTTP500 Jun 13 '12 at 18:39
Thanks, I'll do that – Will Jun 13 '12 at 18:46

Make the apache user a no shell user:


chsh -s /sbin/nologin apache
share|improve this answer
+1. My first thought as well. – MDMarra Jun 13 '12 at 19:01

mod_wsgi has the ability to run as another user, so implement it and set up filesystem permissions appropriately.

If apache runs as root, make it drop privileges too and run under yet another account with no access to the wsgi files.

I wonder if you have to assess the damage incurred by the mod_wsgi use getting shelled :)

Edit: beware, chsh'ing apache user to nologin will not prevent shell access should the Apache process get hit by an exploit. I'd look into selinux if that's a major issue.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.