Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The title says it all; I'm just serving data to coworkers as a courtesy via a series of single-page apps that I basically consolidated under Flask, serving Jinja templates. Presently, I have Apache running, and I just drop static HTML files in the path. But this was before employing Flask or a template engine and I'm unwilling to let it grow to the point that it becomes harder to maintain as a bunch of static HTML.

So in order to make the switch, I can either set up Apache to forward requests to my Flask app, or (b) just turn off Apache, tell my Flask app to app.run(host='0.0.0.0', port=80) and then sudo python myApp.py, done and done.

So is this unsafe? I can't speak to the level of security that our sysadmin employs to prevent outsiders from trolling around our local network, except that "it exists". Our LAN is regarded as inaccessible from the outside, but honestly I don't know anything about this kind of thing. Seems to me that if I can post on Stack Overflow from this computer, Someone Somewhere can see my app running and do Bad Things. I also understand this to be the less preferred practice, especially when something is supposed to be publicly available - but again, I'm just in the office here, and if I don't have to goof around with Apache .conf files then I'm happy to leave them alone and just turn Apache right off.

Am I setting myself up for a giant security fail, or is this fine within this context?

share|improve this question

closed as unclear what you're asking by Xander, Adnan, Polynomial, Noordung, tylerl Jul 22 '13 at 21:14

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Safe from what? From whom? –  Steve Jul 22 '13 at 16:37
    
Safe from the unknown? From people that aren't operating on the LAN? –  Stick Jul 22 '13 at 16:46
    
if you have sysadmins you should let them handle that stuff; running a reverse proxy infront of your app is not that complicated –  that guy from over there Jul 24 '13 at 7:32

1 Answer 1

We can't verify the security controls imposed by your application but just a few remarks regarding your configuration:

  • If you are requiring a username and password, you should require SSL. This certificate can be signed by your company's CA or an official CA. This is to make sure your employees credentials (or yours) stay secure.
  • sudo myapp.py => Big no no here, there are generally no good reasons to run your app as root. You should create a user which cannot login and run it under his name. This user should only have just enough rights to run your application and perform certain file manipulations (for instance write to a certain log folder/file) and nothing else.
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.