I deployed my second rails app on my VDS with capistrano. Should I configure that application server to run as a different user, or the same as the first application?

If I run applications as different users are they safer should one of the applications be compromised?


Yes. These accounts let you limit the amount of damage that an app vulnerability that allows shell access can do.

Let's consider the things you might want to proactively protect:

  1. Static files that are served with same-origin privileges like JavaScript. These should not be writable by any app account since they need only be read and only by the user account for the particular app that serves them.
  2. Log files. These need to be written by a single app account, but not read.
  3. Configuration files and scripts. Some may be shared but they should not be writable by any app account, and unless you have good reason, make per-app config files only readable by that app user.

If your users are tied to database privileges, then any per-app tables should only be modifiable by that app's user, and schema change authority should be reserved to administrators.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.