Best practice for multiple Node applications on one server

Question

I've read that it is the best practive to create seperate system accounts for each application, so in case of a security breach the attacker is isolated inside the specific account and cannot do any more harm.

I would like to inquire what the best practice concerning home directories, and the number of system users is.

I have several Node.js applications, but they all run on the one user account that my server has.

Should I create a user for each application and have their relevant files stored in their home directory, or one user for all node.js applications? Should I not create home directories and have every application in one system directory?

Any pointers* would be greatly appreciated.

Answer 1

Ideally, you should have different applications kept separated, with:

• one user to run the service, like http
• one specific homedirs if data is needed, owned by another user (like httpadmin) with adapted filesystem permissions. Having a group httpgroup for both http and httpadmin users allows for file to be readable by the application but not changeable:

permission user      group     file
-rw-r--r-- httpadmin httpgroup somefile

On top, you should also limit the resources (cpu, memory, process, disk space) used by those users. This can become quite complex to maintain, and technology such as container can help.

All those are basically applications of the Principle of least privilege