Web Hosting Talk







View Full Version : nobody == good!


bombino
06-27-2001, 01:17 AM
Yes, it is to your advantage to continute running Apache as the prividge-less nobody (some systems use the login 'apache', but with the same basic idea).

That way, in the rare event that your web server should by any chance become compromised, the attacker won't be able to access anything else on the system.

If you are going to be using multi-user hosting, then suEXEC is the way to go. That will allow CGI's to run with the permissions of their owner, not the permissions of Apache. This will allow users to keep private files (password lists, billing information, etc.) chmodded 700 (Owner - Full access, Everyone else - No access).

On an interesting side note, however, suEXEC does not affect PHP files running under mod_php.

Hope that's not too confusing!

[Edit] - I typed this as a reply to the thread about httpd/nobody, yet for some odd reason vBulletin put this guy here. Maybe I just screwed up - it's late. ;)

Tim Greer
06-27-2001, 03:00 AM
There's nothing wrong with running a web server as nobody, other than what you've mentioned (and a few other things) that we already discussed, as you mentioned yourself -- so I won't bother to cover those issues again and the alternatives I spoke of (or that other's did as well, since the name of the user or group is irrelevant beyond what you said and what we've all discussed). However, I just wanted to add, that chroot/jailing the web server will also help minimize the possible damage that can be done if it was ever to be exploited. This way, it doesn't have to spawn as a more privileged user, even if it runs as a less privileged user.