Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I deployed my second rails app on my VDS with capistrano. Should I configure that application server to run as a different user, or the same as the first application?

If I run applications as different users are they safer should one of the applications be compromised?

share|improve this question
up vote 2 down vote accepted

Yes. These accounts let you limit the amount of damage that an app vulnerability that allows shell access can do.

Let's consider the things you might want to proactively protect:

  1. Static files that are served with same-origin privileges like JavaScript. These should not be writable by any app account since they need only be read and only by the user account for the particular app that serves them.
  2. Log files. These need to be written by a single app account, but not read.
  3. Configuration files and scripts. Some may be shared but they should not be writable by any app account, and unless you have good reason, make per-app config files only readable by that app user.

If your users are tied to database privileges, then any per-app tables should only be modifiable by that app's user, and schema change authority should be reserved to administrators.

share|improve this answer
Thank you! I see. – zuba Sep 4 '12 at 20:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.