2

I'm running an ubuntu 16.04 web server, with both apache and nginx installed

I need a setup where certain directories (dir y) are inaccessible (no read, write or execute permissions) to a certain user-group (group x)

However, group x should be able to edit the configuration files of nginx and apache

Currently apache and nginx are ran from a privileged user, I suspect that the members of group x may be able to edit the configuration files to read the content of dir y, am I correct in thinking this?

If the apache2 and nginx services are started by an unprivileged user - a member of group x - would this ensure there is no possible way a member of group x could read the content of dir y?

Are there any other loopholes which I should be weary of to ensure dir y stays private?

Edit: After some testing, users of group x are able to edit nginx.conf, setting the nginx user to 'root', which allows dir y to be exposed

I see two solutions, making sure nginx's host process is ran as non-root, which would create problems when binding to port 80 and 443

Or just ensure group x cannot directly edit the nginx.conf file, maybe I could create a program that can edit everything bar the 'user' property

Joe
  • 21
  • 2

1 Answers1

1

My response to this would be to create two groups, such that Group Y would only have access to dir Y, but Group X would include putting the more privileged users in Group Y and Group X so that they would effectively have access to both directories in question.

lupaanst
  • 11
  • 2