1

I have the following users "architecture" :

  1. root access is disabled.
  2. admin user have access only to its home directory.
  3. Apache runs as root service (root is the only one that have access to web-server files)
  4. I have installed jenkins CI which is building my project with "admin" privileges.

i would like to copy latest build files to my webserver location as a post build action. how can i accomplish that if only "root" user has access to my destination directory? maybe my "users architecture" is all wrong in the first place?

4

Maybe my "users architecture" is all wrong in the first place?

Yep. Hate to break it to you, but this is it. Here's how you should change it:

  1. Run Apache as its own user, preferably in a chroot. This is called the principle of minimum privilege - the idea is to limit the damage that can be done in the event that something is compromised. Assume that something will get compromised, and work from there. There's no reason that you should be running Apache as a privileged user.
  2. Run Jenkins CI as its own user. The same principle applies.
  3. Provide some way for the files to get to the webserver directory. For example, you could add the Jenkins user to the Apache group. This should give the Jenkins build server access to the webserver directory. An even safer way would be to run a cron job or a systemd timer as the Apache user, and use that to copy over the files. Why is this safer? If Jenkins is compromised, the attacker won't get access to your webserver directories.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.