Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (hermes.apache.org: local policy)
From: Garth Winter Webb <garth@perijove.com>
To: users@httpd.apache.org
In-Reply-To: <1108127943.420cb0c71436d@webmail.squigly.net>
References: <1108125764.420ca84404c92@webmail.squigly.net>
	 <200502111356.11906@news.perlig.de>
	 <1108126877.420cac9d1eac9@webmail.squigly.net>
	 <200502111405.04428@news.perlig.de>
	 <1108127640.420caf9886187@webmail.squigly.net>
	 <1108127943.420cb0c71436d@webmail.squigly.net>
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Message-Id: <1108136700.27397.5420.camel@jackson.perijove.com>
Mime-Version: 1.0
Date: Fri, 11 Feb 2005 07:45:01 -0800
Subject: Re: [users@httpd] fopen of log files

On Fri, 2005-02-11 at 05:19, alex@squigly.net wrote:
> User nobody
> Group nogroup
> 
> 1. Apache needs to be launched as root in order to bind to a port lower than
> 1024 - this is a basic security feature of all UNIX implementations.
> 
> ----- fair enough
> 
> 2. Immediately after "grabbing" the port, Apache changes its effective user ID
> to something else, typically as user "nobody." This is for security reasons -
> running your Web servers as root means that any hole in the server (be it
> through the server itself, or through a CGI script, which is much more likely)
> could be exploited by an outside user to run a command on your machine.
> 
> ----- so given this, should the logging not then be conducted not by root, but
> by the user/group defined?

Logging is done by the user/group, the file is just provisioned by root
at startup.  The only time you have root in operation is at server
startup.  Anything a malicious user could compromise would be to a
process running as your user/group.

If you are afraid of Apache doing something bad at startup at the hands
of root, it would be a lot easier for someone who has compromised root
to do something bad without the use of Apache.

-- 
Garth Winter Webb <garth@perijove.com>

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org