2

I'm running an ubuntu 16.04 web server, with both apache and nginx installed

I need a setup where certain directories (dir y) are inaccessible (no read, write or execute permissions) to a certain user-group (group x)

However, group x should be able to edit the configuration files of nginx and apache

Currently apache and nginx are ran from a privileged user, I suspect that the members of group x may be able to edit the configuration files to read the content of dir y, am I correct in thinking this?

If the apache2 and nginx services are started by an unprivileged user - a member of group x - would this ensure there is no possible way a member of group x could read the content of dir y?

Are there any other loopholes which I should be weary of to ensure dir y stays private?


Edit: After some testing, users of group x are able to edit nginx.conf, setting the nginx user to 'root', which allows dir y to be exposed

I see two solutions, making sure nginx's host process is ran as non-root, which would create problems when binding to port 80 and 443

Or just ensure group x cannot directly edit the nginx.conf file, maybe I could create a program that can edit everything bar the 'user' property

1

My response to this would be to create two groups, such that Group Y would only have access to dir Y, but Group X would include putting the more privileged users in Group Y and Group X so that they would effectively have access to both directories in question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.