Dropping root privileges (file permissions)

The more direct way to run FreeSWITCH is to run it as "root". Being root, the all-powerful user, the Overlord of the server, a program running as root has no limits whatsoever: No limits on how much memory it can allocate, which network port it can listen to and send from, how many files it can open, which priority and nice level it can escalate, which file and directories it can read and write.

While obviously very convenient for a casual test installation (no integration problems: FreeSWITCH simply owns the machine and all its resources), many users refrain from it.

To limit the reach and damage that a FreeSWITCH process can do after going awry because of a bug (or a malicious exploitation of a bug), you had better run FreeSWITCH as a user with the minimum possible privileges. A "system" kind of user is the most logical choice: No password, no way to login, no affiliation to groups but to "daemon".

This is how it is already implemented by ready-made packages distributed from FreeSWITCH core developers for Debian, CentOS, and other platforms.

Let's see how to do it when compiling FreeSWITCH from source. Start by creating the user:

# useradd --system --home-dir /usr/local/freeswitch -G daemon freeswitch

Then we need to give the new user the ownership of all files related to FreeSWITCH and set the right permissions (or our new user will not be able to access or execute the files):

# chown -R freeswitch:daemon /usr/local/freeswitch/ 
# chmod -R 770 /usr/local/freeswitch/
# chmod -R 750 /usr/local/freeswitch/bin/*

Instead of using some mechanism like "sudo", FreeSWITCH would be better started as root (or similarly privileged user) with -u and -g options. FS will switch to the desired user and group immediately after initialization:

# /usr/local/freeswitch/bin/freeswitch -u freeswitch -g daemon 
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.118.163.142