5

I'm trying to setup a production server, should I create a separate user to run certain application under similar to what apache does? Is it unsafe for them to run as root?

OS: Ubuntu 9.10

The server is for web based applications, It hosts a website but as alot of backed server process's as well

1
  • 1
    Which operating system are you using and what type of production server are you creating?
    – Chris
    Jan 15, 2010 at 21:51

4 Answers 4

4

I prefer to have each application service run as its own user in order to have as much isolation between them as possible. If any part of the system gets broken or compromised I'd like to localise the damage as much as possible.

1

Root is the magic button. As little as possible should run as root.

For the rest, is this a dedicated server? That is, how many applications is it running? Just one, pick any user. Even run it as the web user.

You can basically think of a user as a boundary. If everything runs as the same user (say, www) then all those things have direct access to one another. Should one be compromised, it is all open.

However, for many uses, it doesn't matter. Don't take this wrong, but you don't seem to be a security expert, and so I have a feeling should someone get any access to your machine, it's all over anyway. It takes a dedicated effort to harden a machine against a dedicated attacker.

You didn't mention what language your web application is written in btw. If Ruby on Rails, each application can easily be its own user. If PHP, well, probably not. Probably run those as the web user.

3
  • Ha, no offense taken. I would definitely not call myself a security expert. The web app itself is written in django
    – whatWhat
    Jan 15, 2010 at 22:09
  • 1
    PHP can run quite happily as different users, it's just mod_php that makes it look hard.
    – womble
    Jan 15, 2010 at 23:06
  • Have a look at mod_suphp as a replacement for mod_php in Apache.
    – rodjek
    Jan 16, 2010 at 13:34
0

whatWhat I have each of my django instance running as separate user. This is the best way to do it. I am using Apache + WSGI Daemon process. I had earlier ran all the instances with the same user. But we had randomly faced few problems. As part of fine tuning many things I followed separating the users for each instance. Since then I am not having any problems for the past 8 months.
Like John mentioned anyways if one of your instances get compromised then all the other instances does not have to bother.

0

It is definitely ill advised to run a Python web application as root. If a specific part of the code must run as root, then you would be better off factoring that out into a separate backend service which the main web application communicates with using some interprocess communications process. That back end application should only accept connections from the host the web application runs on and not arbitrary connections from any host.

Besides that, you don't say how you are hosting Django so becomes harder to advise you if you are also after the method to isolate code to run as a specific user. Are you using mod_python, mod_wsgi, fastcgi or proxying to a backend Python WSGI server which is running it?

In worst case your only choice will be for code to run as same user that Apache runs as. This isn't advised if running other applications on same Apache, whether that be Python, PHP or some other language. This is because all the applications can interfere with each other and so a breach in a separate application can still cause you problems.

As such, running individual applications as distinct users and locking down file systems permissions such that each can only access the data for that application is preferable.

If you want an extra level of paranoia then you start looking at running individual applications in a chroot environment.

What exactly you can do is dictated by how you are hosting it, thus why important to know that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .