3 ms·

The author spends the beginning of the article talking about how he takes security very seriously, that his webserver is practically uncompromisable, and that t

The author spends the beginning of the article talking about how he takes security very seriously, that his webserver is practically uncompromisable, and that the odds of it being compromised are so remote because he has "the reflexes of a highly trained ninja" and doesn't run nginx as root. I'm pointing out that his server isn't as uncompromisable as he's trying to lead the reader to believe.

tinix 8y ago
If the author is truly a "ninja" they wouldn't be running their web application as the nginx www-data user in the first place, and then a web application exploit wouldn't inherently give anyone access to the nginx user either to exploit the log-rotation mechanism via symlink. One can read more about the CVE you linked here[1]. But basically the gist of it is this: > As the /var/log/nginx directory is owned by www-data, it is possible for local attackers who have gained access to the system through a vulnerability in a web application running on Nginx (or the server itself) to replace the log files with a symlink to an arbitrary file. This assumes the web application is also running as www-data, which wouldn't be that smart. [1] https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016-1247.html https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-P...
- mbreese 8y ago
  From the article... My site is static too, which means it’s only being hosted through nginx from a non-root user.
  - tinix 8y ago
    Yeah, so then you have to exploit nginx, not a web application. Good luck with that. If someone can get RCE through nginx alone, you're already toast.