I would like to create an API using Nginx (on Ubuntu server) that is able to run processes (execute commands) but www-data is not a user that has access to the data these processes will work on. What is the usual way to do this without compromising security. In other words, how can I make the API execute commands as another user?
Add a comment
|
2 Answers
www-data is just the user that runs the NGINX process by default, I assume your API is running behind NGINX, then your API would execute as www-data. In order to solve what I assume is a permission problem you are having when testing you need to change the permissions of your data (if local) to allow www-data user and/or group to read/write or creating a new user for NGINX to run.
A few pointers when working with an NGINX:
Don't give root access to the user running your web server, because then your web application would have root access over your system, opening up unnecessary vulnerabilities.
Don't make your data public (open permissions for all users) but restrict them to the owner and specific users that will be accessing them, even if you think your server is secured.
If this is not what you are looking for, please elaborate to get better and more accurate answers.
Edit: realised that I never gave you the commands to switch user:
To modify permissions on a file you can use chmod and chown, for example to change permissions of files to the www-data user:
chmod 500 file1 file2 file3
chmod -R 500 directory1/
chown www-data:www-data file1 file2 file3
chown -R www:data:www-data directory1
Should get you started!
Regards
-
This I understand but, on a daily basis, new data under the non-www-data user get written on the location to be worked on, how would I deal with that...– NielsNov 5, 2018 at 13:47
-
1If the data is written by your API, it should automatically get the required permissions to be read later on, assuming the API is run behind the NGINX, if its an external system if would suggest making the user that system run part of the www-data group so even if he writes with his own permissions the NGINX will be able to access the new data.– jtafurthNov 5, 2018 at 13:53
-
In that case just adding that user to the www-data group is not enough. Each file/folder also needs to have that group set... which is not automatically done. Should I do this with like a group mask or something?– NielsNov 5, 2018 at 14:36
-
No, you add www-data to whatever group is being set when creating the files, that way each folder/file has it and your nginx is automatically allowed– jtafurthNov 5, 2018 at 16:38
Maintaining a job list on the executing server and running the jobs (commands) locally with e.g. cron sounded like a nice way of doing it. Completely separating the API that creates the commands and the data to work on. No need for masking and massive chmods etc al the time...