search

sous-chefs / nginx

Development repository for the nginx cookbook
https://supermarket.chef.io/cookbooks/nginx
Apache License 2.0
551 stars 810 forks source link

Insecure default owner/group for files and folders created by nginx_config & nginx_site on Debian based platforms #591

Closed hrak closed 3 years ago

hrak commented 3 years ago

:ghost: Brief Description

The nginx_config and nginx_site resource use insecure default owner/group for files and folders created by nginx_config & nginx_site resources.

The resources use owner nginx_user and nginx_group by default. These default to www-data by default on Debian based distros, allowing any webserver process (f.e. php-fpm) to alter config files or vhost definitions, and create or delete files.

This was already discussed in #572 but the defaults are still insecure.

:pancakes: Cookbook version

12.0.5

:woman_cook: Chef-Infra Version

17.3.48

:tophat: Platform details

Ubuntu 20.04

Steps To Reproduce

Steps to reproduce the behavior:

  1. converge cookbook on Ubuntu 20.04
  2. observe all vhost config files in /etc/nginx/conf.http.d owned by www-data, several folders owned by www-data, nginx.conf owned by www-data

:police_car: Expected behavior

A secure config by default.