Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

New on the job, small place, and the security stuff just landed on my desk. I was hired to be a front-end developer. Happy to learn new things, but never had to do sysadmin stuff before.

I started digging and it appears that apache, the site, and everything is running on root. There are no other groups or users. ACK!

What steps should I take to change this? I know that this is a big no-no...

Bonus points if anyone can please point me to a good basic 101 tutorial on apache/php security.

share|improve this question

1 Answer 1

up vote 6 down vote accepted

It is unusual to find Apache running as root in any stock configuration. How have you determined that Apache is running as root? Note that Apache must start up as root in order to bind to privileged ports, but typically sheds its privileges later on.

You can look in your Apache configuration (often in /etc/httpd or /etc/apache2, depending on your distribution) for the User and Group directives (documented here). These two directives control under what user id Apache runs.

It is also unusual to find a system that has "no other groups or users". What do getent passwd and getent group show? Are there really no other users or groups other than root? Most distributions ship with an apache or www-data user or somesuch and a matching configuration that will run Apache as that user.

There are a variety of introductory guides out there to Apache configuration and security. A simple Google search yields many likely looking results. The RedHat/CentOS Deployment Guide is a good place to start (if you're on a RedHat/CentOS system).

share|improve this answer
    
Thanks, yeah, it wasn't running off root, but it seems that everything else has been done using root. all the folders, files, etc. I'll need to work out how to change that. –  r00tAcc3ss Feb 21 '12 at 17:06
    
Well...not necessarily. You don't want the files owned by the same user as the running Apache process. Ideally, a compromise in the web server will not result in an attacker being able to modify your Apache configuration or web content. –  larsks Feb 21 '12 at 17:23
    
Thank you @larsks –  r00tAcc3ss Feb 21 '12 at 22:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.