Rate my idea: NodeJS as root behind Apache as a proxy with password

Question

I'm the admin of a small Linux server owned by a relative of mine. He's fairly tech savvy, but more at a level of a power user than an expert. I want to make a handy visual tool for him that would allow to do some simple server tasks: add/remove users and change their passwords; set up/remove websites; set up/remove mailboxes (I've decoupled those from system users so it's a separate task if needed); and perhaps something else as needed.

Most of these things can be done from command line and some require the editing of some config files, but lengthy incantations with a lot of changing parts is just asking for trouble. I'd rather have a handy script.

The trouble is: most of these tasks require superuser permissions. He already has that, so I could make a textmode tool (which requires to be run as root), but a website would be so much nicer.

There's already an apache webserver in place on ports 80/443, bit running that as root would obviously be a lousy idea. Similarly, I don't want to store root password anywhere.

So I had the idea of making the website in NodeJS and running the Node process as root, listening only on a specific port which only accepts incoming connections from localhost. Then Apache would be a non-elevated proxy in front of the NodeJS app. In addition, both Apache and NodeJS would ask for a password (taken from the same .htpasswd file).

If you can't enter the password to Apache, you can't even get to Node. If you hack Apache (or have access to some local account) you still need the password to get the Node app to cooperate.

Would this be safe enough? Ok, that's kinda subjective, but considering that I'm more worried about opportunistic hackers from outside than malicious local users, would this be ok? There's really nothing of much value stored on the server; I don't expect anyone to do targeted hacking because there's not much to gain (Wanna see pictures of my kids? You're welcome...) I consider automated scanners and hackers trying to add to their botnets/db leaks the main threat. Any other suggestions on how to achieve this maybe?

Answer 1

You might want to think about running the web server with the normal level of permissions, then setting up the application to store the commands in a text file on the server. Then, a script running on the server with root permissions (either a cron job, or a daemon) can read the commands from the text file and execute them.

This way, you'll achieve your goal of providing your user with a web interface for executing these commands, without running a web server as root. Of course, you'll also want to think carefully about authenticating your user securely. As a second layer of security, you'll probably also want to not allow the user to run arbitrary commands, and restrict the commands that can be run to only those on a whitelist that you specify, and protect against command line injection attacks.