Home / server / Questions / 407076
Accepted
perler
Asked: 2012-07-13 03:30:54 +0800 CST

securing a ruby on rails installation

  • 772

I successfully used this tutorial: http://techbot.me/2010/08/deployment-recipes-deploying-monitoring-and-securing-your-rails-application-to-a-clean-ubuntu-10-04-install-using-nginx-and-unicorn/ for our ruby on rails server.

but I wonder if this installation is safe. what troubles me is that the same user "deployer", who is a sudoer, is running the application.

doesn't this open the possibility that by some form of code injection an attacker gets full access to the system (opposite to a common apache installation where the apache process runs as say www-data)?

security ruby ruby-on-rails

1 Answers

  1. Best Answer

    In general, having the deployer user in sudoers doesn't necessarily mean an attacker is automatically root; the attacker will still need to run sudo to escalate from the deployer account.

    You will be safer by requiring a password for deployer to run sudo. You will be even safer if you restrict the commands that deployer can run with sudo to what's actually required than "everything", e.g., if deployer has sudo privs only so that it can reload nginx, then you can remove it from the "staff" group, and then add in a line to /etc/sudoers like:

    deployer ALL=(ALL) /etc/init.d/nginx reload

    Please see sudo documentation for more details.

    As a side note, the document you're looking at looks more like a basic deployment guide, rather than a "securing your site" guide. Take a look at, for example, this RubyConf talk for something more security specific.

    • 1