This is a followup on my question here.
I am setting up the first webserver and am fumbling with what user accounts to create and permissions to provide for better security. Below is what I have.
For 2 developers, I have 2 accounts (and they are added to the supplementary group devs
) and only they are allowed to ssh to the server. For the web application (Django based), I have created 1 normal user, app
(haven't configured it as --system
user and belongs to group app
) with shell access. The 2 developers, after ssh to the server, will su to app
for any updates and starting/stopping the application. User app
is not allowed to perform su
(blocked by not adding to the group setting in /etc/pam.d/su
using pam_wheel.so
). I also have a 3rd account with no su
capabilities for backup related tasks where a cron job will ssh and fetch log files, status, etc.
Let me know if security aspects need to be made better. (PS: I am a novice here)
su app
maybe you could use either file system ACLs to give appropriate default access rights to the user app. Orchown
all appropriate files from the developers to app either in a cron job or on demand (monitoring the files with a FAM daemon). – peterph Oct 6 '13 at 21:03su app
will gradually turn out to be a pain in the process. But I guess I don't know how to do what you said. May be an example will help? – Ethan Oct 6 '13 at 21:39