nginx service modify user

nginx service modify user

[James Richardson]

[-- Attachment #1: Type: text/plain, Size: 459 bytes --]

Hello,

I've managed to get nginx running as service (I'm running GuixSD). I
would like the nginx user to be in supplementary groups, obviously
usermod and vim /etc/group are not the proper solution.

%nginx-accounts seems not to be exported from (gnu services web).

Is there a way to add supplementary groups to the nginx user?

Thanks,
James
-- 
I prefer encrypted email.
GPG Fingerprint = 8FD2 7619 C19A 2201 CB1D  E131 EA1C F14B D846 7AFB

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 800 bytes --]

Re: nginx service modify user

[Ludovic Courtès]

Hi James,

James Richardson <james@jamestechnotes.com> skribis:

> I've managed to get nginx running as service (I'm running GuixSD). I
> would like the nginx user to be in supplementary groups, obviously
> usermod and vim /etc/group are not the proper solution.
>
> %nginx-accounts seems not to be exported from (gnu services web).
>
> Is there a way to add supplementary groups to the nginx user?

Not yet, but this kind of customization is what’s being discussed at
<https://bugs.gnu.org/27155>, so it’s good that you’re sharing this use
case now.

Out of curiosity, what’s the desired effect of adding these
supplementary groups?

Thanks,
Ludo’.

Re: nginx service modify user

[James Richardson]

Ludovic Courtès writes:

> Hi James,
>
> James Richardson <james@jamestechnotes.com> skribis:
>
>> I've managed to get nginx running as service (I'm running GuixSD). I
>> would like the nginx user to be in supplementary groups, obviously
>> usermod and vim /etc/group are not the proper solution.
>>
>> %nginx-accounts seems not to be exported from (gnu services web).
>>
>> Is there a way to add supplementary groups to the nginx user?
>
> Not yet, but this kind of customization is what’s being discussed at
> <https://bugs.gnu.org/27155>, so it’s good that you’re sharing this use
> case now.
>
> Out of curiosity, what’s the desired effect of adding these
> supplementary groups?

I have files, mostly pictures and videos, whose access is controlled at
the group level on the file system. I typically add that group to the
nginx user, so I provide web access, security is controlled via basic
authentication. I set this up a long time ago (probably 10 years or
more, but it was probably apache then). There are probably better
ways to do this now with better solutions (mediagoblin and nextcloud
come to mind) today. My quick workaround was to move move most things to
the nginx group and open permissions on a few others.

My use case was to give nginx read permissions to a group files by
adding the group to the nginx user. I think I would not do this the same
today (I've a bit in the last decade or so ;).

Apparently, I don't have a use case for this, or least not one I can
justify at the moment (I think I've fell into the "we've always done it
this way trap"). Now it is feasible to achieve isolation by
spinning up a container or vps rather than trying to use groups to
achieve isolation on the same host.

Thanks,
James

Re: nginx service modify user

[Ludovic Courtès]

James Richardson <james@jamestechnotes.com> skribis:

> Ludovic Courtès writes:
>
>> Hi James,
>>
>> James Richardson <james@jamestechnotes.com> skribis:
>>
>>> I've managed to get nginx running as service (I'm running GuixSD). I
>>> would like the nginx user to be in supplementary groups, obviously
>>> usermod and vim /etc/group are not the proper solution.
>>>
>>> %nginx-accounts seems not to be exported from (gnu services web).
>>>
>>> Is there a way to add supplementary groups to the nginx user?
>>
>> Not yet, but this kind of customization is what’s being discussed at
>> <https://bugs.gnu.org/27155>, so it’s good that you’re sharing this use
>> case now.
>>
>> Out of curiosity, what’s the desired effect of adding these
>> supplementary groups?
>
> I have files, mostly pictures and videos, whose access is controlled at
> the group level on the file system. I typically add that group to the
> nginx user, so I provide web access, security is controlled via basic
> authentication. I set this up a long time ago (probably 10 years or
> more, but it was probably apache then). There are probably better
> ways to do this now with better solutions (mediagoblin and nextcloud
> come to mind) today. My quick workaround was to move move most things to
> the nginx group and open permissions on a few others.

I see, that makes sense.

> Apparently, I don't have a use case for this, or least not one I can
> justify at the moment (I think I've fell into the "we've always done it
> this way trap"). Now it is feasible to achieve isolation by
> spinning up a container or vps rather than trying to use groups to
> achieve isolation on the same host.

Yeah, but GuixSD should not prevent this other approach IMO.

Thanks for explaining,
Ludo’.