I deploy web applications by "sandboxing" each application under its own UNIX user account, behind a common nginx reverse proxy that also serves static files. Each account runs the application server, to which nginx will forward requests via fcgi. Each user's home folder hosts the application code and static files, which of course need to be readable by nginx.
I'm trying to secure this setup as much as possible, and /bin/false
came up
while reading up on the topic.
If I was to set the application user's shell to /bin/false
, what would I gain, in terms of security?