I have a Ruby on Rails app and use Capistrano to deploy it to the server.
The deploy user and the user running the app is the same - the default
ubuntu user. (this has sudo access:
ubuntu ALL=(ALL) NOPASSWD:ALL)
Maybe this setup is a bit insecure, in case there is a flaw in my Rails app that allows access to the system via the
I was thinking of making these two users:
deployuser: only has sudo access to start/restart
nginxon the server. Has SSH access to the server.
railsrunner: no sudo access, and has no SSH access (
Is that a good approach? Is there any advantage to having a
deploy user or the
railsrunner user or should I just use the
ubuntu user? (or something else?)