1

I have a server with three custom processes running under a single domain account.

A security "expert" has recommended that three accounts be created, and each one should run under a separate account.

How is that more secure?

4

If you have one account for 3 services this means that if one of the services have a security issue and an attacker can get in, he will access to the other services files for example. By having different accounts, you reduce the impact of this effect. This depends on your case but if you have 3 services such as HTTP, DNS and an LDAP is a good idea to have different accounts for them in general.

|improve this answer|||||
1

Another alternative would be to containerize the services so they don't have host OS access, if security is the goal here.

Separating services by account is not bad, but if someone can compromise one service in such a way that they would otherwise be able to interact with another service running under the same user context, they may be able to elevate privileges to system/root and then interact with the other services anyways.

Containerizing the services removes that escalation path much more easily than other, service-specific controls do.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.