NodeBB in Production: Linux Files Permissions, the right way
I asked that question briefly here but then I figured maybe the community can hAlp:
What’s the right way to setup permissions, say you’re on linux (ubuntu12), running nginx 1.4 with redis
drwxr-xr-x 5 www-data www-data 4096 Feb 20 17:50 mysite.com drwxr-xr-x 2 www-data www-data 4096 Feb 20 17:49 forums.mysite.com
www-datais the nginx user, and a my current user is
adminwhich can sudo btw.
To setup NodeBB in
forums.mysite.com, I will need to
sudoto do anything, from
git cloneto running any command in there, should
adminown that directory? or is it just better to place the NodeBB dir in admin’s home?
What is your conventional way of doing that in production? I still want to be able to setup
supervisorto start on boot too, so calling
supervisorshouldn't need sudo
woops. approved... I need to find a better commenting system for WP ( ooh, wonder what that's going to be)
NodeBB, when listening on an unprivileged port, does not require a privileged user, so I just run it under a regular unix account. As long as that account has write access to
/public/uploads(and wherever else it needs to write things), it should be fine.
NodeBB doesn't need to be owned by the nginx user.
gotcha! I end up doing this, seems to work, but not sure how dangerous that is
sudo adduser admin www-data sudo chown -R :www-data /var/www sudo chmod -R g+rw /var/www
Always best to follow the policy of running apps with the least amount of privileges possible. Then in the event of an arbitrary script execution exploit, your system is ideally protected.
v4 last edited by
How and how often does this happen? 'arbitrary script execution'
@v4 This is a risk with any application, and NodeBB is no exception. Think "zero-day exploits" and applications which accidentally let someone "break out" of the environment. It's obviously something we patch and code against, but finding them is often another matter
We maintain an email specifically for handling these issues: email@example.com. If you've located an exploit vector, email use privately there, and we'll get it fixed up!