This is a followup on my question here.
I am setting up the first webserver and am fumbling with what user accounts to create and permissions to provide for better security. Below is what I have.
For 2 developers, I have 2 accounts (and they are added to the supplementary group
devs) and only they are allowed to ssh to the server. For the web application (Django based), I have created 1 normal user,
app (haven't configured it as
--system user and belongs to group
app) with shell access. The 2 developers, after ssh to the server, will su to
app for any updates and starting/stopping the application. User
app is not allowed to perform
su (blocked by not adding to the group setting in
pam_wheel.so). I also have a 3rd account with no
su capabilities for backup related tasks where a cron job will ssh and fetch log files, status, etc.
Let me know if security aspects need to be made better. (PS: I am a novice here)