2

What security does nginx provide between server blocks?

Here is an example scenario. Say I have two server blocks configured with nginx. Each serves up a web application to authenticated users. I am worried that if one web application is compromised that it could be leveraged to gain access to the other web application.

For example, say one web application has a remote file inclusion vulnerability which allows the attacker to get a shell. That shell would have the privileges of the web server (www-data). With those privileges, the attacker could start reading files from the other web application, right?

Is there any additional separation one could configure into nginx server blocks for added security in this scenario?

Improve this question

1 Answer 1

Reset to default
3

There's no isolation (from a security perspective) between server blocks -- server blocks only exist as a namespace for related directives. Nginx can only have a single user configured, as it becomes that user just after binding to network sockets (which requires root to bind to ports < 1024).

What you can do, and what I have done in the past, is run the applications as different users. You don't specify what language you're using, but for example, I run uwsgi workers, and run them under per-application users to isolate my applications. The sockets need to be read/write www-data (I usually do this via group, so the unix socket for the app server ends up as appname:www-data, mode 0660) and static files need to be readable by nginx (if you want to serve static files directly).

Improve this answer
6
  • +1 that is a good idea. The apps of interest are PHP and I'm running PHP-fpm. So I should be able to run two different php-fpm pools (as different users) like PHP-FPM Tip #3 here
    – mikeazo
    Commented Jun 17, 2014 at 16:30
  • @mikeazo: that's the right solution.
    – that guy from over there
    Commented Jun 17, 2014 at 16:56
  • Right now I'm using tcp sockets for php-fpm. I would have to switch to unix sockets for this to work, right? (not a big deal, just want to make sure).
    – mikeazo
    Commented Jun 17, 2014 at 17:09
  • No, you can use tcp sockets, just need to use different ports for different pools.
    – David
    Commented Jun 17, 2014 at 17:55
  • What user do you run the workers as? If they are running as appname:www-data and static files are readable by www-data group, then someone who exploited the worker process would in one server block could read the files from the other block, right?
    – mikeazo
    Commented Jun 17, 2014 at 17:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .