Non-privileged, non-root, user to start or restart webserver server such as nginx without root or sudo

Question

I'm using capistrano to deploy a rails web app. I want to give the deploy user on the webserver as few privileges as I can. I was able to do everything I need to do as a non-privileged user except restart the webserver.

I'm doing this on an ubuntu server, but this problem is not specific to my use case (rails, capistrano, deployment), and I've seen a lot of approaches to this problem that seem to involve poor security practices. Wondering whether others can vet my solution and advise whether it's secure?

First, not necessary, but I have no idea why /etc/init.d/nginx would need any (even read) access by other users. If they need to read it, make them become root (by sudo or other means), so I:

chmod 750 /etc/init.d/nginx

Since the ownership is owner root, group root (or can be set such with chown root:root /etc/init.d/nginx) only root, or a user properly sudo'ed, can read, change or run /etc/init.d/nginx, and I'm not going to give my deploy user any such broad rights. Instead, I'm only going to give the deploy user the specific sudo right to run the control script /etc/init.d/nginx. They will not be able to run an editor to edit it, because they will only have the ability to execute that script. That means that if a someone gets access to my box as the deploy user, they can restart and stop, etc, the nginx process, but they cannot do more, like change the script to do lots of other, evil things.

Specifically, I'm doing this:

visudo

visudo is a specific tool used to edit the sudoers file, and you have to have sudoer privileges to access it.

Using visudo, I add:

# Give deploy the right to control nginx
deploy ALL=NOPASSWD: /etc/init.d/nginx

Check the sudo man page, but as I understand this, the first column is the user being given the sudo rights, in this case, “deploy”. The ALL gives deploy access from all types of terminals/logins (for example, over ssh). The end, /etc/init.d/nginx, ONLY gives the deploy user root access to run /etc/init.d/nginx (and in this case, the NOPASSWD means without a password, which I need for an unattended deployment). The deploy user cannot edit the script to make it evil, they would need FULL sudo access to do that. In fact, no one can unless they have root access, in which case there's a bigger problem. (I tested that the user deploy could not edit the script after doing this, and so should you!)

What do you folks think? Does this work? Are there better ways to do this? My question is similar to this and this, but provides more explanation than I found there, sorry if it's too duplicative, if so, I'll delete it, though I'm also asking for different approaches.

Answer 1

The best practice is to use /etc/sudoers.d/myuser

The /etc/sudoers.d/ folder can contain multiple files that allow users to call stuff using sudo without being root.

The file usually contains a user and a list of commands that the user can run without having to specify a password. Such as

sudo service nginx restart

Note that we are running the command using sudo. Without the sudo the sudoers.d/myuser file will never be used.

An example of such a file is

myuser ALL=(ALL) NOPASSWD: /usr/sbin/service nginx start,/usr/sbin/service nginx stop,/usr/sbin/service nginx restart

This will allow the myuser user to call all start, stop and restart for the nginx service.

You could add another line with another service or continue to append them to the comma separated list, for more items to control.

Also make shure you have run the command below to secure things

chmod 0440 /etc/sudoers.d/myuser

This is also the way I start and stop services my own created upstart scripts that live in /etc/init It can be worth checking that out if you want to be able to run your own services easily.

Instructions:

In all commands, replace myuser with the name of your user that you want to use to start, restart, and stop nginx without sudo.

1. Open sudoers file for your user:

   $ sudo visudo -f /etc/sudoers.d/myuser
   

2. Editor will open. There you paste the following line:

   $ myusername ALL=(ALL) NOPASSWD: /usr/sbin/service nginx start,/usr/sbin/service nginx stop,/usr/sbin/service nginx restart
   

3. Save by hitting ctrl+o. It will ask where you want to save, simply press enter to confirm the default. Then exit out of the editor with ctrl+x.