Re: Non-root using port 80

From: Jason Dixon (jason_at_dixongroup.net)
Date: 08/11/03

  • Next message: Cowles, Steve: "RE: Spamassassin Automation" 
    To: redhat-list@redhat.com
Date: 11 Aug 2003 06:40:44 -0400

    On Mon, 2003-08-11 at 06:36, diego.veiga@embraer.com.br wrote:

    > I would like to set apache to be started with a user non- user root. As
    > port 1 to 1024 is for user root, how could i start the server with a
    > non-user root?

    You can't. Apache only binds to port 80 as root, then creates all child
    processes with the limited "nobody" (or "apache" or "www") user. A
    process must have root permissions to bind to port 80. Why are you
    concerned about this? If Apache gets exploited and a shell becomes
    available, the user only gains the environment of the limited user. If
    that's not good enough for you, chroot Apache. 

    -- 
Jason Dixon, RHCE
DixonGroup Consulting
http://www.dixongroup.net
-- 
redhat-list mailing list
unsubscribe mailto:redhat-list-request@redhat.com?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list
  • Next message: Cowles, Steve: "RE: Spamassassin Automation"

    Relevant Pages

    • Re: Hardening a Solaris system.
      ... > I know files that execute with root permissions by normal users (e.g. ... > I've set up a web server, running Apache, so are thinking about what I ... thing to leave enabled in here might be a backup port. ... there are security steps here. ...
      (comp.unix.solaris)
    • Re: Hardening a Solaris system.
      ... > I know files that execute with root permissions by normal users (e.g. ... > I've set up a web server, running Apache, so are thinking about what I ... thing to leave enabled in here might be a backup port. ... there are security steps here. ...
      (comp.security.unix)
    • Re: Hardening a Solaris system.
      ... > 1024, where it would not be necessary to start it as root, this would ... You can specify which port Apache uses by modifying httpd.conf. ... versions of Apache running (although given that one can modify ...
      (comp.unix.solaris)
    • Re: Hardening a Solaris system.
      ... > 1024, where it would not be necessary to start it as root, this would ... You can specify which port Apache uses by modifying httpd.conf. ... versions of Apache running (although given that one can modify ...
      (comp.security.unix)
    • Re: AWS applications and domain hosting
      ... > I think that, unlike someone else said, a separate web server, or ... you want it to bind directly to port 80 on the system). ... In Unix you have to be "root" to act as a server on any port in the ... IIRC, Apache is started as "root", but downgrades its ...
      (comp.lang.ada)