Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm setting up a server to do automatic deployment from a Bitbucket git repository, using Bitbucket's postback facility.

Briefly, how it works it:

  1. I commit to Bitbucket
  2. Bitbucket POSTs to a specified script (which only runs if it's called from BB's IP Address)
  3. My script chdirs to the appropriate directory, runs git reset, and git pull to update to latest version (it's a php script using exec()).

I got the idea from:

http://www.stephenradford.me/blog/tutorials/deploy-via-bitbucket-or-github-service-hooks

And overall it seems ok, but it has one major security concern for me - to make it work, you'd need to give apache write access to/ownership of the site directory to do the deployment. This strikes me as a Bad Idea, because then an attacker use apache to write arbitrary files within the directory.

My idea as an alternative is to:

  1. Create another user, 'deploy' then make that the user which owns the site directory.
  2. Use sudoers to enable apache to run a specific shell script as user deploy, and put my git reset, pull command etc in that shell script.
  3. In my exec() calls, do e.g. "sudo -u deploy shell-script.sh"

Can anyone see any flaws/holes with this?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Calling sudo from apache just doesn't sound right, despite the fact that I can't put my finger on the exact set of reasons why it would be a bad idea.

I would suggest instead of doing sudo to just run a very simple CGI as "suexecusergroup deploy" that would receive the postback from bitbucket and perform the git commands. This is a lot more straightforward and sane.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.