Does the `start.sh` script support running the AnQiCMS process with different user identities, how is permission management implemented?
As a senior security CMS website operations personnel, I fully understand the importance of system stability and permission management for website security and operational efficiency. Regardingstart.shThe script runs the AnQiCMS process user identity and permission management, I can elaborate for you.
AnQiCMS is a system developed based on the Go language, which has different operation modes and permission settings from traditional PHP applications, but the core security concept is the same: the principle of least privilege.start.shThe script acts as the startup and guardian script for AnQiCMS under the Linux environment, and the user identity running it is directly related to the permissions of the AnQiCMS process at the operating system level.
start.shThe primary responsibility of the script is to check if the AnQiCMS process is running, and if not, to start it and run it in the background. The identity of the executor of this script and the AnQiCMS main process started thereby is usually determined in the following ways:
In a hosting environment, for example, when deploying AnQiCMS on server management panels such as Baota Panel or aaPanel, these panels usually provide an option to specify the user that the website or Go project runs under. According to the documentation, the Baota Panel deployment guide explicitly states "Choose the running user"wwwThis means that in these managed panel environments,start.shthe script and the AnQiCMS main program it starts will run withwwwRunning as a user (or similar low-privileged web service user). This is a** practice, becausewwwUsers typically only have the most basic permissions needed to run web services, thereby effectively limiting the potential system damage even if the AnQiCMS process is compromised.
When deploying AnQiCMS manually or in a command-line environment,start.shthe running user of the script depends on how you configure and execute it. If you runcrontab -ethe command isstart.shAdd a scheduled task, then the task will be run with thecrontabuser identity of the entry. Generally, we do not recommend running AnQiCMS or any web service process withrootRunning as a user becauserootThe user has the highest system privileges, and if misused, it can bring catastrophic consequences. It is recommended to create a dedicated low-privilege user (such asanqicmsorwww)，andstart.shschedule task configuration under this user, or throughsudo -u <username> start.shin this way to execute with the specified user identity.
No matter which deployment method is used,start.shThe AnQiCMS process started by the script is crucial to its file system access permissions. The user identity running AnQiCMS must have the following permissions: access toanqicmsBinary files andstart.shScript execution permissions; for system log files (such ascheck.log/running.log) and AnQiCMS is used to store user uploaded files, cache data, configuration information, and directory write permissions.The correct permission settings are the cornerstone of ensuring the stable operation and data security of AnQiCMS.
Exceeding the process user identity at the operating system level, AnQiCMS also has established a fine-grained application layer permission management mechanism.The document clearly states that the system supports 'admin group and permission division', and can 'fine-tune the operation permissions of different users.'This means that in the AnQiCMS backend, you can create different user groups and assign specific operational permissions to each user group, such as content editing, content publishing, template modification, system settings, and more.This hierarchical permission control greatly enhances the operational security of the website, ensuring that each backend user can only perform operations within their scope of responsibility, reducing the risk of误operation or malicious operation.
AnQiCMS's permission management is also reflected in the multi-site management function.An AnQiCMS instance can manage multiple independent websites, each of which may have its own administrator account and password, achieving data isolation and independent permission systems.Moreover, the system's built-in 'User Group Management and VIP System' further expands the application scenarios of permission management, allowing access restrictions to specific content based on user identity or payment status, thereby supporting content monetization and membership services.In summary, AnQiCMS provides comprehensive permission control capabilities from operating system process users to application layer background users, aiming to build a safe and efficient content management environment for users.
Frequently Asked Questions
Does the AnQiCMS process support running as root?In technical terms, the AnQiCMS process can be run as the root user, but it is strongly recommended not to do so.The root user has the highest system privileges, and if a security vulnerability occurs in AnQiCMS or its dependent components, an attacker may exploit this vulnerability to completely control the entire server.For security reasons, it is always recommended to use a non-root user with the lowest necessary permissions (such aswwwusers) to run the AnQiCMS process.
How to change the running user identity of AnQiCMS process?Change the user identity of the AnQiCMS process depends on your deployment method.If you use Baota panel or aaPanel and similar management tools, you can directly select or specify the running user in the project configuration of the panel.If it is passed through the command line environmentcrontabThe守护进程, you need to make sure that thestart.shscript is added to the required users'crontab(Throughcrontab -eExecute under this user, or use it before starting the commandsudo -u <username>To specify the user to run.
What permissions does the AnQiCMS process need on the file system?
The AnQiCMS process needs appropriate permissions for the following files and directories: the binary file of the AnQiCMS main program andstart.shScript reading and execution permissions; for log files such ascheck.log/running.log)、User upload file directory, cache directory, and directory containing configuration information, etc., have write permissions.Ensure that the owner of these directories and files is the user running the AnQiCMS process, and that the permission settings follow the principle of least privilege, avoiding unnecessary global write permissions.