Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The default Debian way of setting up a common web server (Nginx) is to run the main process as root and unprivileged workers as www-data. In order to allow for the worker processes to read/execute web application files, some users chown those files to the user www-data.

I have recently read a good argument that states one should never give www-data write access to web application files but rather read and execute rights through being part of a group. I believe that would be the most secure set up I've seen but I'd love to know if anyone has better strategies.

What is the most secure way to configure the user permissions for a web application?

And as a bonus (without leaving the topic of the server itself), what other related configuration tips can you give to securing a web server beyond what you might get from the repos?

share|improve this question
    
The most secure way? Don't allow any network access to it. Oh, you meant the most secure way in which it can still perform an intended function? –  Philipp Mar 7 at 11:54
add comment

2 Answers

Personally I like to activate HTTPs, turn on SElinux, and do something like this in the vhost file:

## Deny access based on HTTP method
if ($bad_method = 1) {
        return 444;
}

location = /robots.txt  { access_log off; log_not_found off; }
location = /favicon.ico { access_log off; log_not_found off; }
## Disable access to hidden files
location ~ /\.          { access_log off; log_not_found off; deny all; }
location ~ ~$           { access_log off; log_not_found off; deny all; }

Also trying to control buffer overflow attacks from the nginx.conf

 ## Start: Size Limits & Buffer Overflows ##
  client_body_buffer_size  1K;
  client_header_buffer_size 1k;
  client_max_body_size 1k;
  large_client_header_buffers 2 1k;
 ## END: Size Limits & Buffer Overflows ##

And then :

  1. NginxHttpLimitZone module should be activated.
  2. Restrict Outgoing Nginx Connections
  3. Directory Restrictions (configure your CMS so that it is only able to read the files it needs; or whatever you need)

The list is long, and this is just a precaution.

share|improve this answer
add comment

What is the most secure way to configure the user permissions for a web application?

well, this depends on your webserver and (the technology of) your application. if you have something like php and apache/mod_php then it would be ideally like this:

  • have a devel-user
  • let the devel-user own your docroot
  • let your webserver-user own it's cache/tmp-directories (or use a modern webapp like contao that doesnt even need that doe tu a so called "safe mode hack")

Why? well, if the webserver itself doent own the files he cannot be tricket into overwriting/altering the files, thus a lot off attacks are not possible.

another point in securing esp. php is using disable_funtions in php.ini, but thats off topic.

if you use apache/suphp then this separation wouldnt work; i'm not sure abot fastcgi.

if you use your webserver as revers-proxy only and an appserver/container (like django, rails, tomcat etc) then you'll need another concept because there's nothing like a docroot.

btw, nginx doesnt execute web application files or runs php.

And as a bonus (without leaving the topic of the server itself), what other related configuration tips can you give to securing a web server beyond what you might get from the repos?

use your google-foo for "securing debian manual", my very young padawan :) this question has been answered a lot on this platform.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.