Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The default Debian way of setting up a common web server (Nginx) is to run the main process as root and unprivileged workers as www-data. In order to allow for the worker processes to read/execute web application files, some users chown those files to the user www-data.

I have recently read a good argument that states one should never give www-data write access to web application files but rather read and execute rights through being part of a group. I believe that would be the most secure set up I've seen but I'd love to know if anyone has better strategies.

What is the most secure way to configure the user permissions for a web application?

And as a bonus (without leaving the topic of the server itself), what other related configuration tips can you give to securing a web server beyond what you might get from the repos?

share|improve this question

closed as too broad by TildalWave, Xander, AJ Henderson, Steve, Adnan Jun 5 at 17:11

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

The most secure way? Don't allow any network access to it. Oh, you meant the most secure way in which it can still perform an intended function? –  Philipp Mar 7 at 11:54

3 Answers 3

Personally I like to activate HTTPs, turn on SElinux, and do something like this in the vhost file:

## Deny access based on HTTP method
if ($bad_method = 1) {
        return 444;

location = /robots.txt  { access_log off; log_not_found off; }
location = /favicon.ico { access_log off; log_not_found off; }
## Disable access to hidden files
location ~ /\.          { access_log off; log_not_found off; deny all; }
location ~ ~$           { access_log off; log_not_found off; deny all; }

Also trying to control buffer overflow attacks from the nginx.conf

 ## Start: Size Limits & Buffer Overflows ##
  client_body_buffer_size  1K;
  client_header_buffer_size 1k;
  client_max_body_size 1k;
  large_client_header_buffers 2 1k;
 ## END: Size Limits & Buffer Overflows ##

And then :

  1. NginxHttpLimitZone module should be activated.
  2. Restrict Outgoing Nginx Connections
  3. Directory Restrictions (configure your CMS so that it is only able to read the files it needs; or whatever you need)

The list is long, and this is just a precaution.

share|improve this answer

What is the most secure way to configure the user permissions for a web application?

well, this depends on your webserver and (the technology of) your application. if you have something like php and apache/mod_php then it would be ideally like this:

  • have a devel-user
  • let the devel-user own your docroot
  • let your webserver-user own it's cache/tmp-directories (or use a modern webapp like contao that doesnt even need that doe tu a so called "safe mode hack")

Why? well, if the webserver itself doent own the files he cannot be tricket into overwriting/altering the files, thus a lot off attacks are not possible.

another point in securing esp. php is using disable_funtions in php.ini, but thats off topic.

if you use apache/suphp then this separation wouldnt work; i'm not sure abot fastcgi.

if you use your webserver as revers-proxy only and an appserver/container (like django, rails, tomcat etc) then you'll need another concept because there's nothing like a docroot.

btw, nginx doesnt execute web application files or runs php.

And as a bonus (without leaving the topic of the server itself), what other related configuration tips can you give to securing a web server beyond what you might get from the repos?

use your google-foo for "securing debian manual", my very young padawan :) this question has been answered a lot on this platform.

share|improve this answer

In case you are talking about PHP websites I have a working solution.

If you have multiple users which have multiple websites(all running with PHP) and you want to isolate them from each other, you can try to use php-fpm together with Nginx. You then create for each website an own fpm-pool where that specific user is used for the execution of that specific fpm-pool, by that users can't interfere with other's users websites, since on a permission level they can't execute code in other directories or even access them. By passing php-variables like 'basedir' to the fpm-pool you can set for example the working directory for that particular PHP interpreter.

You are basically creating an execution context for each individual user and thereby isolating them.

Unfortunately the internet lacks a good tutorial which shows you how to setup everything, but you can work with this tutorial to setup such environment: http://www.if-not-true-then-false.com/2011/nginx-and-php-fpm-configuration-and-optimizing-tips-and-tricks/

You would give the ownership of a particular website directory to a user, which is also in the group www-data, so that static files(html, css, js) still can be called by Nginx.

Let's get more abstract. The above solution basically tells you that you must separate the execution of that program which runs your application files. You only need this security if you need to serve non static files(i.e a call to a php script).

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.