Start node server from bash script without requiring a password

Question

I think this is actually an extremely simple problem and I just don't understand how this is normally solved in linux.

I have a simple node server for receiving post requests from my website. It needs my SSL certificates (/etc/letsencrypt/live/www.ditabase.io/privkey.pem), which means it needs permissions for them.

I would like the server to be able to start up from a bash script without me every having to enter a password, so it can start on boot, and a git post-receive hook can stop the old server and start a new one when I push to production.

All of the following would work, but are obviously insecure/not automatic in some way:

1. Open the certificate permissions to everyone -> nodejs server.js
2. Open the certificate permissions to a group/user, and run node from there -> su nodeuser -c "nodejs server.js"
3. Place a password in the script -> echo PASSWORD | sudo -Su nodeuser nodejs server.js
4. Just start it manually every time? I really don't understand how to solve this.

Answer 1

Permissions

You should not run your node server as root. If your node app is compromised by an attacker, he has root access to your entire machine. Your should keep running your node server by a user with less permissions.

The SSL certificate problem is solved by changing the ownership and permissions of your SSL certificate key files. For example, the public key takes an owner user:usergroup with permission 644 (-rw-r--r--). And private key takes an owner user:ssl-cert with permissions 640 (-rw-r-----). In order to accomplish this, use the following commands (and replace "user", "usergroup" and the paths by the correct values for your machine):

sudo chown user:usergroup pathToPublicKey

sudo chmod 644 pathToPublicKey

sudo chown user:ssl-cert pathToPrivateKey

sudo chmod 640 pathToPrivateKey    

This is not perfect, but there is currently no other way to accomplish this with node (that I am aware of).

Starting node server

Starting up your node server at boot can be accomplished by setting a command that executes your script in rc.local. However, if node crashes, it will not be restarted automatically.

A better solution would be to create a service in systemd. This way, your script can be started at boot, is kept alive by the systemd daemon and it will be restarted automatically if it ever stops. In order to accomplish this, create a file in /lib/systemd/system called myservice.service (and replace "myservice" with a name of your choice). Inside the file, place the following contents (and replace "myusername" to the name of the user on your machine that should run the script, and beware to not use the root user, and input the correct path):

[Unit]
Description=start my node server
After=network.target

[Service]
Environment=NODE_PORT=2999
Type=simple
User=myusername
ExecStart=/usr/bin/node server
WorkingDirectory=pathToTheDirectoryOfYourServerJsFile
Restart=on-failure

[Install]
WantedBy=multi-user.target

After this, restart your machine. Then activate the service by the command

systemctl start myservice 

And enable it on boot by the command

systemctl enable myservice

It is possible to user other daemons than systemd, such as pm2 or forever, but these will consume additional resources from your computer, so using the default deamon systemd that is running anyway, seems like the most logical choice.