You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Nick Kew <ni...@webthing.com> on 2008/11/14 11:22:17 UTC
Introducing mod_privileges for Apache HTTPD
I've just introduced mod_privileges to Apache HTTPD trunk.
This is a platform-specific module for Solaris 10 and OpenSolaris,
that makes the webserver privileges(5)-aware. This enables the
server to be run with enhanced security, and with different
settings per virtual host.
The feature likely to be of most interest is that it enables
different virtual hosts to run under different Unix user and
group IDs, using the VHostUser and VHostGroup directives.
This is the capability once promised by the "perchild" MPM.
It has one major drawback: it is not suitable for a threaded MPM.
However, it is ideally suited for use with PHP, which of course
also precludes threads. It should also be of interest to anyone
hosting other in-process scripting environments such as mod_perl,
mod_python or mod_ruby, or application modules.
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/arch/unix/mod_privileges.c
http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/manual/mod/mod_privileges.xml
--
Nick Kew
Re: Introducing mod_privileges for Apache HTTPD
Posted by Nick Kew <ni...@webthing.com>.
On Mon, 17 Nov 2008 16:51:15 +0900
KaiGai Kohei <ka...@ak.jp.nec.com> wrote:
> Hello, Nick
>
> It seems to me we have similar ideas to enhance web-application
> security. I've focused on SELinux to utilize security features
> of operating system.
>
> I had a plan to start discussion after my PostgreSQL works are
> closed, but, it is a good time to start discussion to utilize
> them for web-applications.
>
> I have a modified version of apache/httpd, as a proof of concept.
>
> http://code.google.com/p/sepgsql/source/browse/misc/httpd-selinux/
> (*) Please copy the "2.2.x" directory as "server/mpm/selinux",
> and append "--with-mpm=selinux"
At a quick look, our concepts appear to be rather different, even
if our goals have something in common. What you're doing looks like
it focuses on the handler phase only, so all the earlier parts of
request processing happen as the default user.
> It enables to invoke request handlers with individual privilege set
> based on http-authenticated username, source IP addresses and so on.
> The typical flow of operations are as follows:
>
> 1. It receives a HTTP request come from client.
>
> 2. It generates a one-time thread to handle the request.
> The parent side wait for completion of the thread.
>
> 3. The one-time thread assigns itself a proper privilege set
> based on the http-authentication and so on.
Sounds very similar to suexec's security model.
> 4. It invokes request handlers to process the given request.
> The request handler works within more restricted privileges.
> When it kick PHP scripts or static contents handlers, the
> restricted privileges are inherited.
>
> 5. The one-time thread returns a http response to the client,
> then it dies soon.
>
> 6. The parent wakes up, and returns to (1).
>
> (*) Please note that SELinux disallow to revert privileges,
> because it can be a vulnerability of unexpected escalation.
As of now, mod_privileges is vulnerable to some forms of attack in
a user application. That may be similar to what you're avoiding.
> Your "mod_privileges" is implemented on the "perchild" MPM.
No, it's just a module, not a new MPM. This fits in with a direction
we're trying to take httpd: the simple MPM and mod_unixd are all part
of an effort to move more of the functions of the MPM to standard
modules.
> It is suitable to achieve per VirtualHost privileges.
> In addition, I think per user/request/network privileges
> enforced by operating system is more worthwhile feature.
>
> A security focused MPM is a key facility to enable the idea.
> I assume it does not give first priority for performances,
> but it enables to resolves some kinds of security nightmares.
Thanks for telling us about your work. It's certainly interesting
enough that I'll have to find the time for a detailed look, and
see if I can build it on a linux box!
--
Nick Kew
Application Development with Apache - the Apache Modules Book
http://www.apachetutor.org/
Re: Introducing mod_privileges for Apache HTTPD
Posted by KaiGai Kohei <ka...@ak.jp.nec.com>.
Hello, Nick
It seems to me we have similar ideas to enhance web-application
security. I've focused on SELinux to utilize security features
of operating system.
I had a plan to start discussion after my PostgreSQL works are
closed, but, it is a good time to start discussion to utilize
them for web-applications.
I have a modified version of apache/httpd, as a proof of concept.
http://code.google.com/p/sepgsql/source/browse/misc/httpd-selinux/
(*) Please copy the "2.2.x" directory as "server/mpm/selinux",
and append "--with-mpm=selinux"
It enables to invoke request handlers with individual privilege set
based on http-authenticated username, source IP addresses and so on.
The typical flow of operations are as follows:
1. It receives a HTTP request come from client.
2. It generates a one-time thread to handle the request.
The parent side wait for completion of the thread.
3. The one-time thread assigns itself a proper privilege set
based on the http-authentication and so on.
4. It invokes request handlers to process the given request.
The request handler works within more restricted privileges.
When it kick PHP scripts or static contents handlers, the
restricted privileges are inherited.
5. The one-time thread returns a http response to the client,
then it dies soon.
6. The parent wakes up, and returns to (1).
(*) Please note that SELinux disallow to revert privileges,
because it can be a vulnerability of unexpected escalation.
Your "mod_privileges" is implemented on the "perchild" MPM.
It is suitable to achieve per VirtualHost privileges.
In addition, I think per user/request/network privileges
enforced by operating system is more worthwhile feature.
A security focused MPM is a key facility to enable the idea.
I assume it does not give first priority for performances,
but it enables to resolves some kinds of security nightmares.
How do you think the concept?
Please any comment,
Thanks,
Nick Kew wrote:
> I've just introduced mod_privileges to Apache HTTPD trunk.
>
> This is a platform-specific module for Solaris 10 and OpenSolaris,
> that makes the webserver privileges(5)-aware. This enables the
> server to be run with enhanced security, and with different
> settings per virtual host.
>
> The feature likely to be of most interest is that it enables
> different virtual hosts to run under different Unix user and
> group IDs, using the VHostUser and VHostGroup directives.
> This is the capability once promised by the "perchild" MPM.
>
> It has one major drawback: it is not suitable for a threaded MPM.
> However, it is ideally suited for use with PHP, which of course
> also precludes threads. It should also be of interest to anyone
> hosting other in-process scripting environments such as mod_perl,
> mod_python or mod_ruby, or application modules.
>
> http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/arch/unix/mod_privileges.c
>
> http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/manual/mod/mod_privileges.xml
--
OSS Platform Development Division, NEC
KaiGai Kohei <ka...@ak.jp.nec.com>
AW: Introducing mod_privileges for Apache HTTPD
Posted by "Plüm, Rüdiger, VF-Group" <ru...@vodafone.com>.
> -----Ursprüngliche Nachricht-----
> Von: "Plüm, Rüdiger, VF-Group"
> Gesendet: Freitag, 14. November 2008 14:58
> An: dev@httpd.apache.org
> Betreff: Re: Introducing mod_privileges for Apache HTTPD
>
>
>
> > -----Ursprüngliche Nachricht-----
> > Von: Nick Kew
> > Gesendet: Freitag, 14. November 2008 11:22
> > An: webstack-discuss; dev@httpd.apache.org
> > Betreff: Introducing mod_privileges for Apache HTTPD
> >
> > I've just introduced mod_privileges to Apache HTTPD trunk.
> >
> > This is a platform-specific module for Solaris 10 and OpenSolaris,
> > that makes the webserver privileges(5)-aware. This enables the
> > server to be run with enhanced security, and with different
> > settings per virtual host.
> >
> > The feature likely to be of most interest is that it enables
> > different virtual hosts to run under different Unix user and
> > group IDs, using the VHostUser and VHostGroup directives.
> > This is the capability once promised by the "perchild" MPM.
> >
> > It has one major drawback: it is not suitable for a threaded MPM.
> > However, it is ideally suited for use with PHP, which of course
> > also precludes threads. It should also be of interest to anyone
> > hosting other in-process scripting environments such as mod_perl,
> > mod_python or mod_ruby, or application modules.
> >
> > http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/arch/un
> > ix/mod_privileges.c
> > http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/manual/mod
> > /mod_privileges.xml
>
> It currently breaks the build on Linux as mod_privileges is build
> by default.
>
Fixed in r714007. mod_privileges is no longer build by default.
You need to add --enable-privileges to your configure call to enable it.
We should add some autofoo magic to check whether all prerequisites
are fulfilled.
Regards
Rüdiger
Re: Introducing mod_privileges for Apache HTTPD
Posted by "Plüm, Rüdiger, VF-Group" <ru...@vodafone.com>.
> -----Ursprüngliche Nachricht-----
> Von: Nick Kew [mailto:nick@webthing.com]
> Gesendet: Freitag, 14. November 2008 11:22
> An: webstack-discuss; dev@httpd.apache.org
> Betreff: Introducing mod_privileges for Apache HTTPD
>
> I've just introduced mod_privileges to Apache HTTPD trunk.
>
> This is a platform-specific module for Solaris 10 and OpenSolaris,
> that makes the webserver privileges(5)-aware. This enables the
> server to be run with enhanced security, and with different
> settings per virtual host.
>
> The feature likely to be of most interest is that it enables
> different virtual hosts to run under different Unix user and
> group IDs, using the VHostUser and VHostGroup directives.
> This is the capability once promised by the "perchild" MPM.
>
> It has one major drawback: it is not suitable for a threaded MPM.
> However, it is ideally suited for use with PHP, which of course
> also precludes threads. It should also be of interest to anyone
> hosting other in-process scripting environments such as mod_perl,
> mod_python or mod_ruby, or application modules.
>
> http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/arch/un
> ix/mod_privileges.c
> http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/manual/mod
> /mod_privileges.xml
It currently breaks the build on Linux as mod_privileges is build
by default.
Regards
Rüdiger
Re: Introducing mod_privileges for Apache HTTPD
Posted by Nick Kew <ni...@webthing.com>.
On Fri, 14 Nov 2008 14:25:15 +0200
Issac Goldstand <ma...@beamartyr.net> wrote:
>
> Cute. I haven't looked at the code yet, but the concept sounds
> awesome.
>
> It would be great if there was a 2.2 backport so I could see if I can
> get it working in our existing stack at work - we're just upgrading
> our web-stack for the next few years, and the latest CoolStack is 2.2
> so no real chance (for us, at least) of adopting this in the next few
> years.
It won't work as a module in 2.2.x. But I do plan to make a patch
to enable the functionality there: it should be much easier having
figured it out as a module. Watch this space!
> I'll try to poke around myself this week but having just come back to
> work from birth-leave I'm really not sure if I'll have a chance.
Your feedback will be appreciated as and when you find time :-)
> Before I jump in too deep, Nick is there any particular reason that
> you think that a backport should NOT be attempted?
No reason at all ... see above.
--
Nick Kew
Application Development with Apache - the Apache Modules Book
http://www.apachetutor.org/
Re: Introducing mod_privileges for Apache HTTPD
Posted by Issac Goldstand <ma...@beamartyr.net>.
Cute. I haven't looked at the code yet, but the concept sounds awesome.
It would be great if there was a 2.2 backport so I could see if I can
get it working in our existing stack at work - we're just upgrading our
web-stack for the next few years, and the latest CoolStack is 2.2 so no
real chance (for us, at least) of adopting this in the next few years.
I'll try to poke around myself this week but having just come back to
work from birth-leave I'm really not sure if I'll have a chance. Before
I jump in too deep, Nick is there any particular reason that you think
that a backport should NOT be attempted?
Issac
Nick Kew wrote:
> I've just introduced mod_privileges to Apache HTTPD trunk.
>
> This is a platform-specific module for Solaris 10 and OpenSolaris,
> that makes the webserver privileges(5)-aware. This enables the
> server to be run with enhanced security, and with different
> settings per virtual host.
>
> The feature likely to be of most interest is that it enables
> different virtual hosts to run under different Unix user and
> group IDs, using the VHostUser and VHostGroup directives.
> This is the capability once promised by the "perchild" MPM.
>
> It has one major drawback: it is not suitable for a threaded MPM.
> However, it is ideally suited for use with PHP, which of course
> also precludes threads. It should also be of interest to anyone
> hosting other in-process scripting environments such as mod_perl,
> mod_python or mod_ruby, or application modules.
>
> http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/arch/unix/mod_privileges.c
>
> http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/manual/mod/mod_privileges.xml
>
>
>
> ------------------------------------------------------------------------
>
> Modules <../mod/> | Directives <../mod/directives.html> | FAQ <../faq/>
> | Glossary <../glossary.html> | Sitemap <../sitemap.html>
>
> Apache HTTP Server Version 2.3
>
> <- <./>
> Apache <http://www.apache.org/> > HTTP Server <http://httpd.apache.org/>
>> Documentation <http://httpd.apache.org/docs/> > Version 2.3 <../> >
> Modules <./>
>
>
> Apache Module mod_privileges
>
> Available Languages: en <../en/mod/mod_privileges.html>
>
> Description: <module-dict.html#Description> Support for Solaris
> privileges and for running virtual hosts under different user IDs.
> Status: <module-dict.html#Status> Experimental
> Module Identifier: <module-dict.html#ModuleIdentifier> privileges_module
> Compatibility: <module-dict.html#Compatibility> Available in Apache 2.3
> and up, on Solaris 10 and OpenSolaris platforms
>
>
> Summary
>
> This module enables different Virtual Hosts to run with different Unix™
> User and Group IDs, and with different Solaris Privileges
> <http://www.sun.com/bigadmin/features/articles/least_privilege.jsp>. In
> particular, it offers a solution to the problem of privilege separation
> between different Virtual Hosts, first promised by the abandoned
> |perchild <../mod/perchild.html>| MPM. It also offers other security
> enhancements.
>
> Unlike |perchild <../mod/perchild.html>|, |mod_privileges
> <../mod/mod_privileges.html>| is not itself an MPM. It works /within/ a
> processing model to set privileges and User/Group /per request/ in a
> running process. It is therefore not compatible with a threaded MPM, and
> will refuse to run under one.
>
> |mod_privileges <../mod/mod_privileges.html>| raises security issues
> similar to those of suexec <../suexec.html>. But unlike suexec, it
> applies not only to CGI programs but to the entire request processing
> cycle, including in-process applications and subprocesses. It is ideally
> suited to running PHP applications under *mod_php*, which is also
> incompatible with threaded MPMs. It is also well-suited to other
> in-process scripting applications such as *mod_perl*, *mod_python*, and
> *mod_ruby*, and to applications implemented in C as apache modules where
> privilege separation is an issue.
>
>
> Directives
>
> * DTracePrivileges <#dtraceprivileges>
> * VHostCGIMode <#vhostcgimode>
> * VHostCGIPrivs <#vhostcgiprivs>
> * VHostGroup <#vhostgroup>
> * VHostPrivs <#vhostprivs>
> * VHostSecure <#vhostsecure>
> * VHostUser <#vhostuser>
>
> top <#page-header>
>
>
> DTracePrivileges Directive
>
> Description: <directive-dict.html#Description> Determines whether the
> privileges required by dtrace are enabled.
> Syntax: <directive-dict.html#Syntax> |DTracePrivileges On|Off|
> Default: <directive-dict.html#Default> |DTracePrivileges Off|
> Context: <directive-dict.html#Context> server config
> Status: <directive-dict.html#Status> Experimental
> Module: <directive-dict.html#Module> mod_privileges
> Compatibility: <directive-dict.html#Compatibility> Available on Solaris
> 10 and OpenSolaris with non-threaded MPMs (|prefork
> <../mod/prefork.html>| or custom MPM).
>
> This server-wide directive determines whether Apache will run with the
> privileges
> <http://www.sun.com/bigadmin/features/articles/least_privilege.jsp>
> required to run dtrace <http://www.sun.com/bigadmin/content/dtrace/>.
> Note that DTracePrivileges On will not in itself activate DTrace, but
> DTracePrivileges Off will prevent it working.
>
> top <#page-header>
>
>
> VHostCGIMode Directive
>
> Description: <directive-dict.html#Description> Determines whether the
> virtualhost can run subprocesses, and the privileges available to
> subprocesses.
> Syntax: <directive-dict.html#Syntax> |VHostCGIMode On|Off|Secure|
> Default: <directive-dict.html#Default> |VHostCGIMode On|
> Context: <directive-dict.html#Context> virtual host
> Status: <directive-dict.html#Status> Experimental
> Module: <directive-dict.html#Module> mod_privileges
> Compatibility: <directive-dict.html#Compatibility> Available on Solaris
> 10 and OpenSolaris with non-threaded MPMs (|prefork
> <../mod/prefork.html>| or custom MPM).
>
> Determines whether the virtual host is allowed to run fork and exec, the
> privileges
> <http://www.sun.com/bigadmin/features/articles/least_privilege.jsp>
> required to run subprocesses. If this is set to Off the virtualhost is
> denied the privileges and will not be able to run traditional CGI
> programs or scripts under the traditional |mod_cgi
> <../mod/mod_cgi.html>|, nor similar external programs such as those
> created by |mod_ext_filter <../mod/mod_ext_filter.html>| or |RewriteMap
> <../mod/mod_rewrite.html#rewritemap>| prog. Note that it does not
> prevent CGI programs running under alternative process and security
> models such as mod_fcgid <http://fastcgi.coremail.cn>, which is a
> recommended solution in Solaris.
>
> If set to On or Secure, the virtual host is permitted to run external
> programs and scripts as above. Setting |VHostCGIMode| Secure has the
> effect of denying privileges to the subprocesses, as described for
> |VHostSecure|.
>
> top <#page-header>
>
>
> VHostCGIPrivs Directive
>
> Description: <directive-dict.html#Description> Assign arbitrary
> privileges to subprocesses created by a virtual host.
> Syntax: <directive-dict.html#Syntax> |VHostPrivs [+-]?privilege-name
> [[+-]?privilege-name] ...|
> Default: <directive-dict.html#Default> |None|
> Context: <directive-dict.html#Context> virtual host
> Status: <directive-dict.html#Status> Experimental
> Module: <directive-dict.html#Module> mod_privileges
> Compatibility: <directive-dict.html#Compatibility> Available on Solaris
> 10 and OpenSolaris with non-threaded MPMs (|prefork
> <../mod/prefork.html>| or custom MPM) and when |mod_privileges
> <../mod/mod_privileges.html>| is compiled with the BIG_SECURITY_HOLE
> compile-time option.
>
> |VHostCGIPrivs| can be used to assign arbitrary privileges
> <http://www.sun.com/bigadmin/features/articles/least_privilege.jsp> to
> subprocesses created by a virtual host, as discussed under
> |VHostCGIMode|. Each privilege-name is the name of a Solaris privilege,
> such as file_setid or sys_nfs.
>
> A privilege-name may optionally be prefixed by + or -, which will
> respectively allow or deny a privilege. If used with neither + nor -,
> all privileges otherwise assigned to the virtualhost will be denied. You
> can use this to override any of the default sets and construct your own
> privilege set.
>
>
> Security
>
> This directive can open huge security holes in apache subprocesses, up
> to and including running them with root-level powers. Do not use it
> unless you fully understand what you are doing!
>
> top <#page-header>
>
>
> VHostGroup Directive
>
> Description: <directive-dict.html#Description> Sets the Group ID under
> which a virtual host runs.
> Syntax: <directive-dict.html#Syntax> |VHostGroup unix-groupid|
> Default: <directive-dict.html#Default> |Inherits the group id specified
> in |Group <../mod/mod_unixd.html#group>||
> Context: <directive-dict.html#Context> virtual host
> Status: <directive-dict.html#Status> Experimental
> Module: <directive-dict.html#Module> mod_privileges
> Compatibility: <directive-dict.html#Compatibility> Available on Solaris
> 10 and OpenSolaris with non-threaded MPMs (|prefork
> <../mod/prefork.html>| or custom MPM).
>
> The |VHostGroup| directive sets the Unix group under which the server
> will process requests to a virtualhost. The group is set before the
> request is processed and reset afterwards using Solaris Privileges
> <http://www.sun.com/bigadmin/features/articles/least_privilege.jsp>.
> Since the setting applies to the /process/, this is not compatible with
> threaded MPMs.
>
> Unix-group is one of:
>
> A group name
> Refers to the given group by name.
> |#| followed by a group number.
> Refers to a group by its number.
>
>
> Security
>
> This directive cannot be used to run apache as root! Nevertheless, it
> opens potential security issues similar to those discussed in the suexec
> <../suexec.html> documentation.
>
>
> See also
>
> * |Group <../mod/mod_unixd.html#group>|
> * |SuexecUserGroup <../mod/mod_suexec.html#suexecusergroup>|
>
> top <#page-header>
>
>
> VHostPrivs Directive
>
> Description: <directive-dict.html#Description> Assign arbitrary
> privileges to a virtual host.
> Syntax: <directive-dict.html#Syntax> |VHostPrivs [+-]?privilege-name
> [[+-]?privilege-name] ...|
> Default: <directive-dict.html#Default> |None|
> Context: <directive-dict.html#Context> virtual host
> Status: <directive-dict.html#Status> Experimental
> Module: <directive-dict.html#Module> mod_privileges
> Compatibility: <directive-dict.html#Compatibility> Available on Solaris
> 10 and OpenSolaris with non-threaded MPMs (|prefork
> <../mod/prefork.html>| or custom MPM). and when |mod_privileges
> <../mod/mod_privileges.html>| is compiled with the BIG_SECURITY_HOLE
> compile-time option.
>
> |VHostPrivs| can be used to assign arbitrary privileges
> <http://www.sun.com/bigadmin/features/articles/least_privilege.jsp> to a
> virtual host. Each privilege-name is the name of a Solaris privilege,
> such as file_setid or sys_nfs.
>
> A privilege-name may optionally be prefixed by + or -, which will
> respectively allow or deny a privilege. If used with neither + nor -,
> all privileges otherwise assigned to the virtualhost will be denied. You
> can use this to override any of the default sets and construct your own
> privilege set.
>
>
> Security
>
> This directive can open huge security holes in apache, up to and
> including running requests with root-level powers. Do not use it unless
> you fully understand what you are doing!
>
> top <#page-header>
>
>
> VHostSecure Directive
>
> Description: <directive-dict.html#Description> Determines whether the
> server runs with enhanced security for the virtualhost.
> Syntax: <directive-dict.html#Syntax> |VHostSecure On|Off|
> Default: <directive-dict.html#Default> |VHostSecure On|
> Context: <directive-dict.html#Context> virtual host
> Status: <directive-dict.html#Status> Experimental
> Module: <directive-dict.html#Module> mod_privileges
> Compatibility: <directive-dict.html#Compatibility> Available on Solaris
> 10 and OpenSolaris with non-threaded MPMs (|prefork
> <../mod/prefork.html>| or custom MPM).
>
> Determines whether the virtual host processes requests with security
> enhanced by removal of Privileges
> <http://www.sun.com/bigadmin/features/articles/least_privilege.jsp> that
> are rarely needed in a webserver, but which are available by default to
> a normal Unix user and may therefore be required by modules and
> applications. It is recommended that you retain the default (On) unless
> it prevents an application running. Since the setting applies to the
> /process/, this is not compatible with threaded MPMs.
>
>
> Note
>
> If |VHostSecure| prevents an application running, this may be a warning
> sign that the application should be reviewed for security.
>
> top <#page-header>
>
>
> VHostUser Directive
>
> Description: <directive-dict.html#Description> Sets the User ID under
> which a virtual host runs.
> Syntax: <directive-dict.html#Syntax> |VHostUser unix-userid|
> Default: <directive-dict.html#Default> |Inherits the userid specified in
> |User <../mod/mod_unixd.html#user>||
> Context: <directive-dict.html#Context> virtual host
> Status: <directive-dict.html#Status> Experimental
> Module: <directive-dict.html#Module> mod_privileges
> Compatibility: <directive-dict.html#Compatibility> Available on Solaris
> 10 and OpenSolaris with non-threaded MPMs (|prefork
> <../mod/prefork.html>| or custom MPM).
>
> The |VHostUser| directive sets the Unix userid under which the server
> will process requests to a virtualhost. The userid is set before the
> request is processed and reset afterwards using Solaris Privileges
> <http://www.sun.com/bigadmin/features/articles/least_privilege.jsp>.
> Since the setting applies to the /process/, this is not compatible with
> threaded MPMs.
>
> Unix-userid is one of:
>
> A username
> Refers to the given user by name.
> |#| followed by a user number.
> Refers to a user by its number.
>
>
> Security
>
> This directive cannot be used to run apache as root! Nevertheless, it
> opens potential security issues similar to those discussed in the suexec
> <../suexec.html> documentation.
>
>
> See also
>
> * |User <../mod/mod_unixd.html#user>|
> * |SuexecUserGroup <../mod/mod_suexec.html#suexecusergroup>|
>
> Available Languages: en <../en/mod/mod_privileges.html>
>
> Copyright 2008 The Apache Software Foundation.
> Licensed under the Apache License, Version 2.0
> <http://www.apache.org/licenses/LICENSE-2.0>.
>
> Modules <../mod/> | Directives <../mod/directives.html> | FAQ <../faq/>
> | Glossary <../glossary.html> | Sitemap <../sitemap.html>
>