0

I want to set some environment variables on my linux box that can be accessed by a node.js server. These variables will contain sensitive information like database passwords and API keys.

My current setup is that a user with nearly no privileges (it can't even sudo) runs the node.js server. Because I want to limit what this user can do/know to just running the server (misguided?), I don't want to put the env variables in the user's ~/.bash_profile.

So my thought was to put the environment variables needed for the server into /etc/profile; that way, the low privilege user running the server wouldn't have the variables in their config, but could still use them. However, the permissions on /etc/profile are such that everyone has read access which makes logical sense but leaves me back where I started.

What is the best practice for web server environment variables on a linux system? If they can always be read by any user then what makes environmental variables a better practice than just importing a text file with keys and values located at the project root into the web server (like dotenv)? Is it that environment variables aren't a security thing and rather just a best practice of maintenance which is why I can't connect the dots here?

2
  • 1
    Even if the user couldn't read the file where environmental variables are stored, they could always just grab them from the running shell. You can see this by running env command in shell.
    – sebasth
    Sep 19, 2017 at 15:53
  • @sebasth That is a really good point. I now feel like environment variables exist to conform to the 12 factor app and don't have their roots in security which is why my understanding isn't lining up. If I drop my assumption that env var's help with security this all makes more sense.
    – zarroboogs
    Sep 19, 2017 at 17:53

2 Answers 2

Reset to default
1

You should not save any sensitive data in plain text. It should be encrypted so no one can decrypt it.

Add all config in JSON file Encrypt JSON file using some password and save on server While running application decrypt the file and use variables

Refer this module: https://github.com/nareshv/secure-conf

Note: To protect such code you can make your javascript in an unreadable format on production using https://javascriptobfuscator.com/.

Using such technique can save your code.

0

You could add them to a file owned by a different group. Then configure /etc/sudoers to allow this user to run the server under as the other group.

This will not give the user any other sudo privileges (such as root). You can then use a shell wrapper to help the user.

Sudo is very configurable.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .