Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 6 down vote favorite

We have a contracted web developer that uses deployment scripts to update and deploy web sites. In order for them to work they require write access to the whole webroot through the httpd user.

I have tried to convince them to upload their changes by ftp or even scp, they just don't want to.

Can you provide me with authorative sources that agree with my position? (supposing I am right with my concerns, please let me know if I am wrong)

share|improve this question
This is a bad idea, although after the site is deployed you could remove write privileges. – Rook Jul 31 '12 at 22:33
1  
Yes. This is what I have been doing. I open up permissions for them to deploy and then close them again. Though one thing has me confused here, the window they require full access is days; AFAIK web development should not be done on a production server; write it and test on dev environment and then deploy. It should only take minutes as best imo. – Ablue Jul 31 '12 at 22:38
Is gross incompetence a valid reason to break the contract? – Michael Hampton Jul 31 '12 at 22:55
@MichaelHampton: Trust me, this is not off the table. We are just trying to make it work at this stage. – Ablue Jul 31 '12 at 22:57

2 Answers

up vote 5 down vote accepted

I think you are correct if the httpd user has more rights than the dev should have.

Also when I have my rules and the dev doesn't want to hear them, I just pass the work to the next guy in the row.

The risks:

  • They need shell access to your machines
  • They need access to the httpd user (they can control your webservers basically)

Any of the above means they can mess around with stuff they shouldn't be messing about with. Apart from that they can configure your webserver to ONLY work with their scripts, meaning that if you ever break contract with them, you will be in a lot of hurt to get this fixed. (This is a possibility, not saying they will)

If you allow them shell access I advice you to, by contract(!), draw out what they can touch and what they can't. (talk softly with a big stick)

Like you are saying, if their scripts should only be writing to a certain dir, then there is definitely no need to give them anything else than a shell that can write into the webfolder. If they need access to certain configuration files, you can add them to the httpd group. If they need access to restart a webserver, you just give them sudo for the restart command.

Never give anyone more clearance than they need to get the job done. If marketing persists you outline very carefully what can happen if these devs fail and create downtime and how this can affect company image. Make sure you cover yourself as well.

EDIT

They want to run their own access scripts as a httpd user so they can have full write access with a browser?

This is not really a good idea, if that thing gets breached you are in for a lot of hurt.

The best thing I can come up with at the moment is this nist guide: http://csrc.nist.gov/publications/nistpubs/800-44-ver2/SP800-44v2.pdf (check chapter 5.2)

an article by searchsecurity on why you should use a dev server:

http://searchsecurity.techtarget.com/tip/Six-steps-to-securing-your-Web-server

share|improve this answer
Unfortunately I am just a sysadmin. My manager and I agree, but marketing want to hang on to this dev team because they like their work. At this stage we want to keep them but convince them their work practices need to change. – Ablue Jul 31 '12 at 22:35
I can give them a captive shell and lock them to a directory. problem is they still dont want to deploy like this. So specifically I need authorative sources to support my position rather than advice. – Ablue Jul 31 '12 at 22:43
@EDIT: That was my concern. So what I am after are sources that support this opinion and concern. I suppose I could use this post to support my concern but are you able to quote and sources? – Ablue Jul 31 '12 at 22:52
@Ablue added a link to a guide by Nist, I think that's as authoritative as it gets – Lucas Kauffman Jul 31 '12 at 23:02
@EDIT: Thanks Lucas, I will take what I can get here. – Ablue Jul 31 '12 at 23:04
show 1 more comment
up vote 2 down vote

In order to use ftp or scp, the developer will need to use a particular login that has write access to the webroot. While the httpd user has that same write access, it also has additional privileges that your developer doesn't need, and which can be dangerous if handed out carelessly.

The best practice is the principle of least privilege, which says to only give users (and processes, and scripts) the access they need and no more.

share|improve this answer
as a note, their deployment scripts shouldn't care what user they run as, so long as they have write access to the correct locations. – ImaginaryRobots Jul 31 '12 at 22:37
scripts need to be run by a process. In this case the process is the httpd – Ablue Jul 31 '12 at 22:40
...also at least there is authentication to access the file system with ssh or ftp(s). Allowing httpd full access to the webroot does not require any authentication by the user. – Ablue Jul 31 '12 at 22:41
so the deployment scripts are started/accessed through a web browser? That's weird and would scare me if it was on my servers. – ImaginaryRobots Jul 31 '12 at 22:44
This is a REALLY BAD IDEA. – Lucas Kauffman Jul 31 '12 at 22:45
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.