[techtalk] Running Apache as Root

[JamesA.Sutherland]

On Wed, 11 Apr 2001 07:52:43 -0700 (PDT), you wrote:

>Thank you for your answers.  I think I was not clear
>enough in my question. I not only start Apache as
>root, but I run it in such as way that the little
>httpd processes that are generally listed as belonging
>to nobody are also running as root.  This is an
>unusual way to run Apache and requires that
>"BIG_SECURITY_HOLE" be specified when I compile
>Apache.
>(http://dev.apache.org/apidoc/apidoc_BIG_SECURITY_HOLE.html)
>
>Thank you for the suggestion to Disallow  user created
>.htaccess lists, we do have users on this server.  
>
>I am still curious if I would be safer if I moved the
>part of the module that needs to be run as root to a
>program that was external to Apache, but which
>communicated with Apache via a pipe.  Is the danger
>having anything running as root on the server, or just
>having the apache child processes running as root?

Some Apache features in 2.0 are implemented this way, in fact: cgid,
for example. (And the old NIS+ authentication support I wrote a few
years ago, although that's not public.) A fair amount of effort went
into making sure that was securely done, of course...

Short answer: keep Apache running as nobody, put the root stuff into a
process of its own. Ideally, drop root privileges from it as well
ASAP, although of course that may not be possible; chroot and/or
capability restrictions would also be a good idea, if possible.


James.