douling1936 2015-06-19 07:50
浏览 38
已采纳

将Golang作为www-data运行

When I run a Node HTTP server app I usually call a custom function

function runAsWWW()
{
 try 
 {
  process.setgid('www-data');
  process.setuid('www-data');
 } catch (err) 
 {
  console.error('Cowardly refusal to keep the process alive as root.');
  process.exit(1);
 }
}

from server.listen(8080,'localhost',null,runAsWWW);

so the server is actually running as the www-data user to offer a better modicum of security. Is there something similar I can do when I start up a Golang web server by issuing go run index.go?

  • 写回答

4条回答 默认 最新

  • doujiyong7604 2015-06-19 21:39
    关注

    Expanding on @JimB's answer:

    Use a process supervisor to run your application as a specific user (and handle restarts/crashes, log re-direction, etc). setuid and setgid are universally bad ideas for multi-threaded applications.

    Either use your OS' process manager (Upstart, systemd, sysvinit) or a standalone process manager (Supervisor, runit, monit, etc).

    Here's an example for Supervisor:

    [program:yourapp]
    command=/home/yourappuser/bin/yourapp # the location of your app
    autostart=true
    autorestart=true
    startretries=10
    user=yourappuser # the user your app should run as (i.e. *not* root!)
    directory=/srv/www/yourapp.com/ # where your application runs from
    environment=APP_SETTINGS="/srv/www/yourapp.com/prod.toml" # environmental variables
    redirect_stderr=true
    stdout_logfile=/var/log/supervisor/yourapp.log # the name of the log file.
    stdout_logfile_maxbytes=50MB
    stdout_logfile_backups=10
    

    Further: if you're not reverse proxying and your Go application needs to bind to a port < 1024 (e.g. port 80 or 443) then use setcap - for example: setcap cap_net_bind_service=+ep /home/yourappuser/bin/yourapp

    PS: I wrote a little article on how to run Go applications with Supervisor (starting from "I don't have Supervisor installed").

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论
查看更多回答(3条)
编辑
预览

报告相同问题?

悬赏问题

  • ¥15 求Houdini使用行家,付费。价格面议。
  • ¥15 AttributeError: 'EasyDict' object has no attribute 'BACKUP_DB_INFO'
  • ¥15 前端高拍仪调用问题报错
  • ¥15 想用octave解决这个数学问题
  • ¥15 Centos新建的临时ip无法上网,如何解决?
  • ¥15 海康威视如何实现客户端软件对设备语音请求的处理。
  • ¥15 支付宝h5参数如何实现跳转
  • ¥15 MATLAB代码补全插值
  • ¥15 Typegoose 中如何使用 arrayFilters 筛选并更新深度嵌套的子文档数组信息
  • ¥15 CF1927D 求Hack