Permissions and ownership in recursive mode on /opt/netbox

[sylvievartan]

Hello friends and all,

I have just upgraded from 3.6.3 to 3.7.1

I took the liberty of positioning this on /opt/netbox :
chmod 760 -R /opt/netbox
chown -R netbox:netbox /opt/netbox

Do you validate thos settings ? All seems to work good so far.
Do you recommend another settings for permissions and ownership ?

[markkuleinio]

I wouldn't recommend having the netbox user owning and having write permissions for the application files.

Having root (as in instructions) or some other user owning the application files ensures that the running code (running as netbox user) doesn't have possibility to change its own behavior.

[sylvievartan]

Thank you Mark for your reply,
and what about the permissions 760 ?... Do you have an idea ?

[markkuleinio]

Yes: 0760 makes no sense.

What is your Linux distribution, and what is your motivation to changing the default permissions?

[sylvievartan]

Hello Markku,

The OS is an Ubuntu VERSION="22.04.2 LTS (Jammy Jellyfish)"

the goal is just to test a hardening on this kind of server, although its access is exclusive from internal.
What is the permissions you used to apply : 755 ? Or another permission setting ?

Thank you for your help.

[markkuleinio]

I use the Debian platform defaults (umask = 0022), meaning that directories will be 0755 and files 0644 (except the files that are specifically set as executable in NetBox repository, like upgrade.sh and manage.py). Owner root:root (as resulted by the normal NetBox installation procedure), except for the specific directories configured during the install.

These are good: netbox is not able to modify the code, and only the specific files are executable.

If you have local non-admin users on the host, you may want to set /opt/netbox/netbox/netbox/configuration.py group to netbox and then set access to 0640 (to prevent local users from reading the database passwords etc).