Should I use system user account as opposed to normal user account for deploying the code in App server?

Question

I have a Tornado app-server running behind an Nginx web-server. The app server contains python scripts for tasks like processing client requests, database call, running business logic, etc.

Of course, the code must be executed via a Operating System user account. Now I see that in Linux, two types of OS accounts are possible: a normal user account and a system account (the later one created using --system option, uses /usr/false and has no home directory).

My questions are:

[1] Should I use system user account as opposed to a normal user account to deploy and run the codes?

[2] Is system user account more secure than a normal user account?

[3] In which directory should I keep my code files (from security point of view)?

Information:

1) I don't intend to use the account running the python code for any other purpose.

2) I am using supervisord and virtualenv in my production environment.

3) I intend to do detailed monitoring of the log files.

Being system administrator, I am asking this question from security point of view. Will be happy to learn from you guys. Thanks in advance.

Answer 1

If you can deploy using an account, this implies that the account has some remote access capability - which makes no sense for 'system account' - the only way the system account can get the code onto the filesystem would be pulling it onto the server. It's not impossible but requires a bit of thought.

Running the code is a different story. Most servers run as a specific non-root uid - but usually do so by being started by root then calling setuid() (this also means they can open privileged ports) - but it's trivial to wrap the startup script so that it's run by root but creates the daemon as a different user.

Is system user account more secure

Depends - secure is a very broad banner for a lot of different things. But in terms of running the daemon, it does provide some protection.

In which directory should I keep my code files (from security point of view)?

What's your security model? Where are your logs? Who should have legitimate access to the system? Is the machine dedicated for the purposes of running your code or does it do other things?