Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I successfully used this tutorial: http://techbot.me/2010/08/deployment-recipes-deploying-monitoring-and-securing-your-rails-application-to-a-clean-ubuntu-10-04-install-using-nginx-and-unicorn/ for our ruby on rails server.

but I wonder if this installation is safe. what troubles me is that the same user "deployer", who is a sudoer, is running the application.

doesn't this open the possibility that by some form of code injection an attacker gets full access to the system (opposite to a common apache installation where the apache process runs as say www-data)?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

In general, having the deployer user in sudoers doesn't necessarily mean an attacker is automatically root; the attacker will still need to run sudo to escalate from the deployer account.

You will be safer by requiring a password for deployer to run sudo. You will be even safer if you restrict the commands that deployer can run with sudo to what's actually required than "everything", e.g., if deployer has sudo privs only so that it can reload nginx, then you can remove it from the "staff" group, and then add in a line to /etc/sudoers like:

deployer ALL=(ALL) /etc/init.d/nginx reload

Please see sudo documentation for more details.

As a side note, the document you're looking at looks more like a basic deployment guide, rather than a "securing your site" guide. Take a look at, for example, this RubyConf talk for something more security specific.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.