6

We have a contracted web developer that uses deployment scripts to update and deploy web sites. In order for them to work they require write access to the whole webroot through the httpd user.

I have tried to convince them to upload their changes by ftp or even scp, they just don't want to.

Can you provide me with authorative sources that agree with my position? (supposing I am right with my concerns, please let me know if I am wrong)

4
  • This is a bad idea, although after the site is deployed you could remove write privileges.
    – rook
    Jul 31, 2012 at 22:33
  • 1
    Yes. This is what I have been doing. I open up permissions for them to deploy and then close them again. Though one thing has me confused here, the window they require full access is days; AFAIK web development should not be done on a production server; write it and test on dev environment and then deploy. It should only take minutes as best imo.
    – Matt
    Jul 31, 2012 at 22:38
  • Is gross incompetence a valid reason to break the contract? Jul 31, 2012 at 22:55
  • @MichaelHampton: Trust me, this is not off the table. We are just trying to make it work at this stage.
    – Matt
    Jul 31, 2012 at 22:57

2 Answers 2

5

I think you are correct if the httpd user has more rights than the dev should have.

Also when I have my rules and the dev doesn't want to hear them, I just pass the work to the next guy in the row.

The risks:

  • They need shell access to your machines
  • They need access to the httpd user (they can control your webservers basically)

Any of the above means they can mess around with stuff they shouldn't be messing about with. Apart from that they can configure your webserver to ONLY work with their scripts, meaning that if you ever break contract with them, you will be in a lot of hurt to get this fixed. (This is a possibility, not saying they will)

If you allow them shell access I advice you to, by contract(!), draw out what they can touch and what they can't. (talk softly with a big stick)

Like you are saying, if their scripts should only be writing to a certain dir, then there is definitely no need to give them anything else than a shell that can write into the webfolder. If they need access to certain configuration files, you can add them to the httpd group. If they need access to restart a webserver, you just give them sudo for the restart command.

Never give anyone more clearance than they need to get the job done. If marketing persists you outline very carefully what can happen if these devs fail and create downtime and how this can affect company image. Make sure you cover yourself as well.

EDIT

They want to run their own access scripts as a httpd user so they can have full write access with a browser?

This is not really a good idea, if that thing gets breached you are in for a lot of hurt.

The best thing I can come up with at the moment is this nist guide: http://csrc.nist.gov/publications/nistpubs/800-44-ver2/SP800-44v2.pdf (check chapter 5.2)

an article by searchsecurity on why you should use a dev server:

http://searchsecurity.techtarget.com/tip/Six-steps-to-securing-your-Web-server

6
  • Unfortunately I am just a sysadmin. My manager and I agree, but marketing want to hang on to this dev team because they like their work. At this stage we want to keep them but convince them their work practices need to change.
    – Matt
    Jul 31, 2012 at 22:35
  • I can give them a captive shell and lock them to a directory. problem is they still dont want to deploy like this. So specifically I need authorative sources to support my position rather than advice.
    – Matt
    Jul 31, 2012 at 22:43
  • @EDIT: That was my concern. So what I am after are sources that support this opinion and concern. I suppose I could use this post to support my concern but are you able to quote and sources?
    – Matt
    Jul 31, 2012 at 22:52
  • @Ablue added a link to a guide by Nist, I think that's as authoritative as it gets Jul 31, 2012 at 23:02
  • @EDIT: Thanks Lucas, I will take what I can get here.
    – Matt
    Jul 31, 2012 at 23:04
3

In order to use ftp or scp, the developer will need to use a particular login that has write access to the webroot. While the httpd user has that same write access, it also has additional privileges that your developer doesn't need, and which can be dangerous if handed out carelessly.

The best practice is the principle of least privilege, which says to only give users (and processes, and scripts) the access they need and no more.

7
  • as a note, their deployment scripts shouldn't care what user they run as, so long as they have write access to the correct locations. Jul 31, 2012 at 22:37
  • scripts need to be run by a process. In this case the process is the httpd
    – Matt
    Jul 31, 2012 at 22:40
  • ...also at least there is authentication to access the file system with ssh or ftp(s). Allowing httpd full access to the webroot does not require any authentication by the user.
    – Matt
    Jul 31, 2012 at 22:41
  • so the deployment scripts are started/accessed through a web browser? That's weird and would scare me if it was on my servers. Jul 31, 2012 at 22:44
  • This is a REALLY BAD IDEA. Jul 31, 2012 at 22:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .