This post originated from an RSS feed registered with Java Buzz by Simon Brown. Original Post: Securing Pebble #2 : Don't run your server as root Feed Title: Simon Brown's weblog Feed URL: http://www.simongbrown.com/blog/feed.xml?flavor=rss20&category=java Feed Description: My thoughts on Java, software development and technology. Latest Java Buzz Posts Latest Java Buzz Posts by Simon Brown Latest Posts From Simon Brown's weblog

This is another often-overlooked point, but don't run your production app/web server as root. Should somebody manage to hack in (by uploading a JSP or otherwise executing some code on the server), that code will have access to everything root does. Run your server as an unprivileged user and don't forget to lock down the files they need to read/write.