I am just starting out with Django and want to deploy a test application on a Linux VPS that I have. I am not familiar with how I can secure the deployment. If I configure Apache to serve the application from my projects directory under /home then I believe there is scope that someone with malicious intent might access my entire /home.

I was thinking of creating another user. Is there a better option?

Thanks Hari


Django projects are not meant to be put in the document root. Put it under /srv and point WSGIScriptAlias accordingly.


The best security practice for Django deployment is to use one user for each "site", this is easy to do with mod_wsgi, for each virtual host, you have something like this : :

<IfModule mod_wsgi.c>
    WSGIDaemonProcess mydeploygroup user=_myuser group=_mygroup threads=25
    WSGIProcessGroup mydeploygroup
    WSGIScriptAlias / /srv/vhosts/www.example.org/apps/myapp/wsgi/deployment.wsgi

This is a good practice to have your .py files into a read-only location accessible only from this specific user. That way, if an attacker is able to upload arbitrary files, permissions prevent him from modifying existing Python code and backdoor it.

There is also a chroot feature but I have never tested it. Does anyone have a feedback?


You don't really need anything at all under DocumentRoot. Your WSGIScriptAlias should point at the wsgi-file, which can be anywhere the user www-data can read from. The wsgi-file in turn points at your Django-project, which can also be anywhere www-data can read from.

There doesn't seem to be any official rules on how to set up your structure. Personally I have all my projects in subfolders to /var/www.


If you don't need the whole internet to access you application, think about add some firewall rules to restrict access to the application.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.