9

On this VPS there are three users: root, another_one, nobody. All webserver files, configs, &c. are owned by root. However, I'm in doubt for what regards running things. If I use root for the web server I may expose the system to security holes, whereas if I try to login into nobody it asks me a password which I never set and I don't know. Should I create yet another user?

For now I'm only sure about nginx: I run it as root and it spawns processes as nobody. But what about web servers and other services like db and redis?

Note: I should mention that another_user can sudo, so it's not that different from root.

2 Answers 2

9

I always run services with a dedicated user. So I would create these users:

  • nginx
  • mongo
  • apache
  • mysql
  • redis

You should never run the actual services as root!

Often when installing these applications using your distributions package manager, as part of the installation, a user will be automatically created for each of these services.

I typically use CentOS/RHEL and when I install things like Apache, the user "apache" is created automatically at that point. So too for MySQL, and Nginx.

4
  • Well thanks! Yes, when installing redis for example I found that a redis user was created as well. I will follow this advice, thanks.
    – rubik
    Jul 20, 2013 at 16:40
  • I'm now configuring things and with multiple users setting specific permissions is easier!
    – rubik
    Jul 20, 2013 at 16:41
  • I like this approach. Out of curiosity, what is your strategy for groups? Do you have a services group? Or do you keep a separate group for each service-user?
    – Patrick M
    Jan 3, 2014 at 17:24
  • @PatrickM - seperate groups. Services should be walled off as much as possible from each other.
    – slm
    Jan 3, 2014 at 17:58
1

You are right in hesitating to run services as root. You will be better off creating separate users for the web server. It wouldn't hurt to also read about the file ownership and permission discussion in https://serverfault.com/questions/357108/what-are-the-best-linux-permissions-to-use-for-my-website

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .