You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Jose Gutierrez <bc...@yahoo.es> on 2003/04/02 18:32:10 UTC
running apache as root
Can anyone tell me razonable reasons because apache must not run as root user?
i want to configures apache for hosting an unique web (my web) at my dedicated server, serving php and perl cgi's. I am mainly warred about stability of the system.
thanks.
Re: running apache as root
Posted by Enrico Weigelt <we...@metux.de>.
On Wed, Apr 02, 2003 at 06:32:10PM +0200, Jose Gutierrez wrote:
hi,
> Can anyone tell me razonable reasons because apache must not
> run as root user?
Thats not correct, it may run as root, but you really should
think very careful about that. The httpd is written in C, this
allows many leaks (i.e buffer overflows).
Why do you need to run it as root ?
cu
--
---------------------------------------------------------------------
Enrico Weigelt == metux ITS
Webhosting ab 5 EUR/Monat. UUCP, rawIP und vieles mehr.
phone: +49 36207 519931 www: http://www.metux.de/
fax: +49 36207 519932 email: contact@metux.de
cellphone: +49 174 7066481 smsgate: sms.weigelt@metux.de
---------------------------------------------------------------------
Diese Mail wurde mit UUCP versandt. http://www.metux.de/uucp/
Re: running apache as root
Posted by Jim Jagielski <ji...@jaguNET.com>.
At 6:32 PM +0200 4/2/03, Jose Gutierrez wrote:
>Can anyone tell me razonable reasons because apache must not run as
>root user?
>
>i want to configures apache for hosting an unique web (my web) at my
>dedicated server, serving php and perl cgi's. I am mainly warred
>about stability of the system.
>
>thanks.
Running as root opens the door to loads of stupid security risks, which
will adversely affect stability.
All CGIs, for example, will run as root. Ask yourself if that's a good thing :)
--
===========================================================================
Jim Jagielski [|] jim@jaguNET.com [|] http://www.jaguNET.com/
"A society that will trade a little liberty for a little order
will lose both and deserve neither" - T.Jefferson
Re: running apache as root
Posted by Markus Welsch <ma...@suk.net>.
> Can anyone tell me razonable reasons because apache must not run as
> root user?
Security ... if the apache process contains a security hole and it's
executed as root it leads to root user access ...
Re: running apache as root
Posted by André Malo <nd...@perlig.de>.
* Jose Gutierrez wrote:
> Can anyone tell me razonable reasons because apache must not run as root user?
It's not designed to be run as root. Look for example, how much effort is
taken in suexec to make sure that the sytem won't be compromised. The httpd
itself doesn't care much about such effort (except for the startup code, of
course).
And - an httpd is designed to grant public access to resources. Do you
really want to allow everybody to execute programs on your machine *as
root*?
> i want to configures apache for hosting an unique web (my web) at my
> dedicated server, serving php and perl cgi's. I am mainly warred about
> stability of the system.
Especially the modular concept is dangerous for running as root. Do you
*know* that mod_php and your cgis resp. any of the modules are safe? Nobody
knows, so they're probably not. There are two much possibilities how the
different components may interact.
Finally, I think, you're asking the wrong question. It should be: "Why do I
want the httpd to be run as root?"
HTH, nd
--
"Eine Eieruhr", erklärt ihr Hermann, "besteht aus einem Ei. Du nimmst
das Ei und kochst es. Wenn es hart ist, sind fünf Minuten um. Dann weißt
du, daß die Zeit vergangen ist."
-- Hannes Hüttner in "Das Blaue vom Himmel"
Re: running apache as root
Posted by Sebastian Wolfgarten <se...@gmx.net>.
Hi Jose,
running apache as root user is extremly dangerous because
an attacker could compromise your whole system and gain
root privileges remotely.
By the way, this ain't a developer related question, is it?
In the future please post these questions on the users lists.
Bye,
Sebastian
Re: running apache as root
Posted by Graham Leggett <mi...@sharp.fm>.
Jose Gutierrez wrote:
> the perchild mpm seems like nice but i think it is not enought stable. I was
> thinking about the posibility of developing a simple apache module which
> change the user and group for each virtualhost.
The suexec module does this already - see the Apache v1.3 and v2.0 docs.
Regards,
Graham
--
-----------------------------------------
minfrin@sharp.fm "There's a moon
over Bourbon Street
tonight..."
Re: running apache as root
Posted by Enrico Weigelt <we...@metux.de>.
On Wed, Apr 02, 2003 at 07:17:25PM +0200, Jose Gutierrez wrote:
moin,
<snip>
> the perchild mpm seems like nice but i think it is not enought stable. I was
> thinking about the posibility of developing a simple apache module which
> change the user and group for each virtualhost.
metuxmpm.
already working, but still under heavy development.
maillist: muxmpm@metux.de
subscribe w/ mail to majordomo@metux.de ("subscribe muxmpm" as body)
cu
--
---------------------------------------------------------------------
Enrico Weigelt == metux ITS
Webhosting ab 5 EUR/Monat. UUCP, rawIP und vieles mehr.
phone: +49 36207 519931 www: http://www.metux.de/
fax: +49 36207 519932 email: contact@metux.de
cellphone: +49 174 7066481 smsgate: sms.weigelt@metux.de
---------------------------------------------------------------------
Diese Mail wurde mit UUCP versandt. http://www.metux.de/uucp/
Re: running apache as root
Posted by Jose Gutierrez <bc...@yahoo.es>.
i know what a root user is (sorry if my question wasn't enought clearly
formulated):
the perchild mpm seems like nice but i think it is not enought stable. I was
thinking about the posibility of developing a simple apache module which
change the user and group for each virtualhost.
The only viable way i know for doing this is running apache as root (or
patch apache, but i dont like this).
With this module apache child wouldn`t run as root , so i thing there
wouldn´t be security problem at this point, only stability problems
(perhaps)
That`s the reason becouse i an posting at this list. I think you must know
about the stabilitiy of running apache as root (i have heard something about
race conditions, and things like this).
thanks.
----- Original Message -----
From: "Chris Taylor" <ch...@x-bb.org>
To: <de...@httpd.apache.org>
Sent: Wednesday, April 02, 2003 7:39 PM
Subject: Re: running apache as root
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> I think you might find it helpful to read into the Unix-like user
> system.......... ;)
>
> And really, the dev list isn't the best for this, subscribe to the
> users list....
>
> HTH,
>
> Chris Taylor - chris@x-bb.org - The guy with the PS2 WebServer -
> http://www.x-bb.org/chris.asc
>
> - ----- Original Message -----
> From: "Jose Gutierrez" <bc...@yahoo.es>
> To: <de...@httpd.apache.org>
> Sent: Wednesday, April 02, 2003 4:32 PM
> Subject: running apache as root
>
>
> Can anyone tell me razonable reasons because apache must not run as
> root user?
>
> i want to configures apache for hosting an unique web (my web) at my
> dedicated server, serving php and perl cgi's. I am mainly warred
> about stability of the system.
>
> thanks.
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>
>
> iQA/AwUBPosgSyqf8lmE2RZkEQJcGQCdHUmWZcyVkcP3aQ5njhTYMOc2ZGEAoND+
> SI9YhIfSbsxrN+5PG4Ow4d5K
> =Filg
> -----END PGP SIGNATURE-----
>
Re: running apache as root
Posted by Chris Taylor <ch...@x-bb.org>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I think you might find it helpful to read into the Unix-like user
system.......... ;)
And really, the dev list isn't the best for this, subscribe to the
users list....
HTH,
Chris Taylor - chris@x-bb.org - The guy with the PS2 WebServer -
http://www.x-bb.org/chris.asc
- ----- Original Message -----
From: "Jose Gutierrez" <bc...@yahoo.es>
To: <de...@httpd.apache.org>
Sent: Wednesday, April 02, 2003 4:32 PM
Subject: running apache as root
Can anyone tell me razonable reasons because apache must not run as
root user?
i want to configures apache for hosting an unique web (my web) at my
dedicated server, serving php and perl cgi's. I am mainly warred
about stability of the system.
thanks.
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>
iQA/AwUBPosgSyqf8lmE2RZkEQJcGQCdHUmWZcyVkcP3aQ5njhTYMOc2ZGEAoND+
SI9YhIfSbsxrN+5PG4Ow4d5K
=Filg
-----END PGP SIGNATURE-----