8

On this VPS there are three users: root, another_one, nobody. All webserver files, configs, &c. are owned by root. However, I'm in doubt for what regards running things. If I use root for the web server I may expose the system to security holes, whereas if I try to login into nobody it asks me a password which I never set and I don't know. Should I create yet another user?

For now I'm only sure about nginx: I run it as root and it spawns processes as nobody. But what about web servers and other services like db and redis?

Note: I should mention that another_user can sudo, so it's not that different from root.

9

I always run services with a dedicated user. So I would create these users:

  • nginx
  • mongo
  • apache
  • mysql
  • redis

You should never run the actual services as root!

Often when installing these applications using your distributions package manager, as part of the installation, a user will be automatically created for each of these services.

I typically use CentOS/RHEL and when I install things like Apache, the user "apache" is created automatically at that point. So too for MySQL, and Nginx.

  • Well thanks! Yes, when installing redis for example I found that a redis user was created as well. I will follow this advice, thanks. – rubik Jul 20 '13 at 16:40
  • I'm now configuring things and with multiple users setting specific permissions is easier! – rubik Jul 20 '13 at 16:41
  • I like this approach. Out of curiosity, what is your strategy for groups? Do you have a services group? Or do you keep a separate group for each service-user? – Patrick M Jan 3 '14 at 17:24
  • @PatrickM - seperate groups. Services should be walled off as much as possible from each other. – slm Jan 3 '14 at 17:58
1

You are right in hesitating to run services as root. You will be better off creating separate users for the web server. It wouldn't hurt to also read about the file ownership and permission discussion in https://serverfault.com/questions/357108/what-are-the-best-linux-permissions-to-use-for-my-website

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.