title: AWS EB and Node ExpressJS server security
body: <p>I am new to AWS and Linux and was looking through expressJS docs where it is recommended that the root owner of the ExpressJS server is dropped to a normal user with minimum privileges.</p>
  
  <pre><code>http.createServer(app).listen(app.get('port'), function(){  
      console.log("Express server listening on port " + app.get('port'));  
      process.setgid(config.gid);  
      process.setuid(config.uid);  
  });
  </code></pre>
  
  <p>source: <a href="https://blog.liftsecurity.io/2012/12/07/writing-secure-express-js-apps" rel="nofollow">https://blog.liftsecurity.io/2012/12/07/writing-secure-express-js-apps</a></p>
  
  <p>I created an AWS ElasticBand Linux server, deployed my code and logged on via SSH and created a group and user via</p>
  
  <pre><code>sudo groupadd testGroup
  sudo useradd -g testGroup testUser
  </code></pre>
  
  <p>I ran <b>id -a testUser</b> and took the user and group values uid=502(testUser) gid=502(testGroup) groups=502(testGroup) and I assigned them to the main.js, the logs pipped out the following error</p>
  
  <pre><code>http.createServer(app).listen(app.get('port'), function(){  
      console.log("Express server listening on port " + app.get('port'));  
      process.setgid(502);  
      process.setuid(502);  
  });
  
  
  /var/app/current/main.js:182
          process.setgid(502);
                  ^
  
  Error: EPERM, Operation not permitted
      at Error (native)
      at Server.&lt;anonymous&gt; (/var/app/current/main.js:182:17)
      at Server.g (events.js:260:16)
      at emitNone (events.js:67:13)
      at Server.emit (events.js:166:7)
      at emitListeningNT (net.js:1263:10)
      at nextTickCallbackWith1Arg (node.js:430:9)
      at process._tickCallback (node.js:352:17)
      at Function.Module.runMain (module.js:444:11)
      at startup (node.js:136:18)
  </code></pre>
  
  <p>I tried putting in the user and group names instead and got the same error message.</p>
  
  <p>Any ideas here? </p>