7:15 p.m.
When I first started using Red Hat Linux 8.0 I was reading through the
Red Hat Linux Security Guide and it said to always shut down Apache when
logged in as root to prevent hackers from coming in through the web
server. I've always done it because the Security Guid said to, but
never really understood why. How would hackers come in through the web
server? I realize that they could telnet in, but wouldn't they have to
log in as a user? What exactly would happen? Can anyone tell me how
this would be accomplished? It's annoying having to stop Apache when I
log in to work on the system and then starting it again when I log
out...
7:16 p.m.
On Thu, 8 Jul 2004, Michael Sullivan wrote:
When I first started using Red Hat Linux 8.0 I was reading through
the
Red Hat Linux Security Guide and it said to always shut down Apache when
logged in as root to prevent hackers from coming in through the web
server. I've always done it because the Security Guid said to, but
never really understood why. How would hackers come in through the web
server? I realize that they could telnet in, but wouldn't they have to
log in as a user? What exactly would happen? Can anyone tell me how
this would be accomplished? It's annoying having to stop Apache when I
log in to work on the system and then starting it again when I log
out...
Um, I've never heard of that restriction. You should never _RUN_ the
webserver as root (the same goes for any processes that interact with the
outside world where at all possible).
Perhaps thats where the confusion comes from ?
The reason for not running a webserver as root is that any method that a
hacker uses to compromise that webserver will then have a greater level
(e.g. root) of access into your system. read and modify any files, trash
your disks.. etc...
Cheers,
Al
10:05 p.m.
On Thu, 2004-07-08 at 22:56, Jorge Fábregas wrote:
On Thursday 08 July 2004 8:16 pm, Alan Horn wrote:
> You should never _RUN_ the webserver as root
Hi,
How then you make Apache listen to port 80 (a port below 1024) as another user
other than root? ..since only root may use those ports below 1024.
Jorge
Apache has options in the httpd.conf file that let you specify what user
apache should run as. I believe by default that user is apache. In the
past or on other OSes I believe they used the nobody user. The main
thing is to run it as an unprivileged user so if someone finds an
exploit they are limited to the privileges of a non root user.
--
Scot L. Harris
webid(a)cfl.rr.com
Doctors and lawyers must go to school for years and years, often with
little sleep and with great sacrifice to their first wives.
-- Roy G. Blount, Jr.
8:53 a.m.
On Thu, 2004-07-08 at 21:56, Jorge Fábregas wrote:
On Thursday 08 July 2004 8:16 pm, Alan Horn wrote:
> You should never _RUN_ the webserver as root
Hi,
How then you make Apache listen to port 80 (a port below 1024) as another user
other than root? ..since only root may use those ports below 1024.
Jorge
No,
the daemon is started as root, but spawns child processes that drop root
privileges and run as apache. see below:
root 10718 8.7 1.8 23504 9704 ? S 08:45 0:00
/usr/sbin/httpd
apache 10721 0.0 1.8 23504 9724 ? S 08:45 0:00
/usr/sbin/httpd
apache 10722 0.0 1.8 23504 9720 ? S 08:45 0:00
/usr/sbin/httpd
apache 10723 0.0 1.8 23504 9720 ? S 08:45 0:00
/usr/sbin/httpd
apache 10724 0.0 1.8 23504 9720 ? S 08:45 0:00
/usr/sbin/httpd
apache 10725 0.0 1.8 23504 9720 ? S 08:45 0:00
/usr/sbin/httpd
apache 10726 0.0 1.8 23504 9720 ? S 08:45 0:00
/usr/sbin/httpd
apache 10727 0.0 1.8 23504 9720 ? S 08:45 0:00
/usr/sbin/httpd
apache 10728 0.0 1.8 23504 9720 ? S 08:45 0:00
/usr/sbin/httpd
r
The first is the parent that initially launches the process (the
'queen') and runs as root. The others are the worker bees that handle
all requests, and the parent never handles an incoming request. All the
workers run as apache, only the 'queen' runs as root and all that
process does is monitor and control the others. The ones running as
apache handle all requests and if they get compromised, they only have
the privileges of the user apache.
10:42 a.m.
New subject: Working as root while Apache is running; how much a risk? (repost after subject line error)
Can you clarify what "_RUN_ the web server" means? My current practice
is this: The only way I work on my server PC is through ssh from a
client computer because my server PC doesn't have a monitor hooked up to
it. Anyway, I log in as root and the very first thing I do is "service
httpd stop". I go about doing whatever task I have to do in that
session and then I say, "service httpd start; exit". Are you saying
that I don't have to have Apache stopped while I'm logged in as root, or
are you saying I shouldn't stay logged in as root after I issue "service
httpd start"?
Date: Thu, 8 Jul 2004 17:16:07 -0700 (PDT)
From: Alan Horn <ahorn(a)deorth.org>
Subject: Re: Working as root while Apache is running; how much a risk?
To: For users of Fedora Core releases <fedora-list(a)redhat.com>
Message-ID: <Pine.NEB.4.60.0407081714230.962(a)slick.sigje.org>
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
On Thu, 8 Jul 2004, Michael Sullivan wrote:
> When I first started using Red Hat Linux 8.0 I was reading through
the
> Red Hat Linux Security Guide and it said to always shut down
Apache
when
> logged in as root to prevent hackers from coming in through the
web
> server. I've always done it because the Security Guid said to, but
> never really understood why. How would hackers come in through the
web
> server? I realize that they could telnet in, but wouldn't
they have
to
> log in as a user? What exactly would happen? Can anyone tell
me
how
> this would be accomplished? It's annoying having to stop
Apache
when I
> log in to work on the system and then starting it again when I
log
> out...
Um, I've never heard of that restriction. You should never _RUN_ the
webserver as root (the same goes for any processes that interact with
the
outside world where at all possible).
Perhaps thats where the confusion comes from ?
The reason for not running a webserver as root is that any method that
a
hacker uses to compromise that webserver will then have a greater
level
(e.g. root) of access into your system. read and modify any files,
trash
your disks.. etc...
Cheers,
Al
------------------------------
10:58 a.m.
New subject: Working as root while Apache is running; how much a risk? (repost after subject line error)
On Fri, 2004-07-09 at 11:42, Michael Sullivan wrote:
Can you clarify what "_RUN_ the web server" means? My
current practice
is this: The only way I work on my server PC is through ssh from a
client computer because my server PC doesn't have a monitor hooked up to
it. Anyway, I log in as root and the very first thing I do is "service
httpd stop". I go about doing whatever task I have to do in that
session and then I say, "service httpd start; exit". Are you saying
that I don't have to have Apache stopped while I'm logged in as root, or
are you saying I shouldn't stay logged in as root after I issue "service
httpd start"?
He means the user the processes for httpd run as. If you do a
ps -eax | grep httpd
on your system you will see a list of processes and the user they run
as. In this case they should be showing apache as the user.
In some systems they use nobody as the user for these process.
So you don't need to shutdown apache when you do maintenance as root.
--
Scot L. Harris
webid(a)cfl.rr.com
You will have a head crash on your private pack.
1:10 p.m.
New subject: Working as root while Apache is running; how much a risk? (repost after subject line error)
Broadening this topic a bit,
are there any general guidance documents as to what 'user' should
run what apps or utilities?
Or even what users/groups to set up?
I'm referring to a single user setup rather than an administered one.
TIA, DaveP
2:01 p.m.
New subject: Working as root while Apache is running; how much a risk? (repost after subject line error)
On Fri, 2004-07-09 at 14:10, Dave Pawson wrote:
Broadening this topic a bit,
are there any general guidance documents as to what 'user' should
run what apps or utilities?
Or even what users/groups to set up?
I'm referring to a single user setup rather than an administered one.
TIA, DaveP
Have not seen anything that specifically addresses this. However you
can get an idea by looking at a brand new installs /etc/passwd file.
Many of those entries are defaults. Others will depend on the packages
you install.
The best rule is to always always always run with the least amount of
privileges you can. Use root as little as possible. Obviously there
are some things that only root can do. If it is a single person system
then you can relax this rule a little but it is better to run as a
normal user as much as possible.
On multi-user systems you should use su to get to root privileges or
even better configure sudo to limit the commands that people can/need to
run as root. It is a nice way to permit people to run certain things as
root but not grant root access to the entire system.
Disable direct root login to the box, force a user to login as
themselves then use su or sudo to get root privileges.
And last always run with the least amount of privileges you can. Did I
already say that? :)
--
Scot L. Harris
webid(a)cfl.rr.com
"I've got some amyls. We could either party later or, like, start his
heart."
-- "Cheech and Chong's Next Movie"
2:04 p.m.
New subject: Working as root while Apache is running; how much a risk? (repost after subject line error)
On Fri, 2004-07-09 at 20:01, Scot L. Harris wrote:
On multi-user systems you should use su to get to root privileges or
even better configure sudo to limit the commands that people can/need to
run as root. It is a nice way to permit people to run certain things as
root but not grant root access to the entire system.
Thanks Scot, Sounds like a good idea. I'll look into that.
What about running tomcat or apache?
Any guidelines on creating users/groups for such as that?
regards DaveP
2:25 p.m.
New subject: Working as root while Apache is running; how much a risk? (repost after subject line error)
On Sat, 2004-07-10 at 15:04, Dave Pawson wrote:
What about running tomcat or apache?
Any guidelines on creating users/groups for such as that?
regards DaveP
The typical apache install from the rpms I think defaults to using the
user apache. If you install the sources from the web site I believe
they use the user nobody by default.
This is an option you can set in the httpd.conf file. Which ever user
you use should NOT have a login shell. The idea is that this is an
unprivileged user so on the off chance that someone finds and uses a
flaw to gain shell access to the server they would be limited in what
they could do. They may be able to use that access to employ yet
another exploit to gain root access but it makes it that much more
difficult.
I have not played much with tomcat. Used it a little with opennms I
think but nothing very serious. The same ideas should apply, run them
with the fewest privileges possible to get the job done. And where
possible leave an audit trail. (that is what forcing someone to login
as a user account and then suing or using sudo will do for you.)
I also recommend you study any security documentation for each of those
packages provided by the developers. They will know much better than I
how to secure their packages.
Good security starts with a healthy dose or two or paranoia and
suspicion regarding everything! And remember the two most likely
sources of compromise is poor physical security and people you trust
with access to the system.
--
Scot L. Harris
webid(a)cfl.rr.com
You can get everything in life you want, if you will help enough other
people get what they want.
11:47 a.m.
New subject: Working as root while Apache is running; how much a risk? (repost after subject line error)
Try this:
ps -ef | grep httpd
What you should see is something like below:
apache 10423 1125 0 04:02 ? 00:00:00 /usr/sbin/httpd
-DHAVE_ACCESS -D
apache 10424 1125 0 04:02 ? 00:00:00 /usr/sbin/httpd
-DHAVE_ACCESS -D
apache 10425 1125 0 04:02 ? 00:00:00 /usr/sbin/httpd
-DHAVE_ACCESS -D
apache 10426 1125 0 04:02 ? 00:00:00 /usr/sbin/httpd
-DHAVE_ACCESS -D
apache 10427 1125 0 04:02 ? 00:00:00 /usr/sbin/httpd
-DHAVE_ACCESS -D
apache 10428 1125 0 04:02 ? 00:00:00 /usr/sbin/httpd
-DHAVE_ACCESS -D
apache 10429 1125 0 04:02 ? 00:00:00 /usr/sbin/httpd
-DHAVE_ACCESS -D
apache 10430 1125 0 04:02 ? 00:00:00 /usr/sbin/httpd
-DHAVE_ACCESS -D
Now if you see root where apache is that means your httpd server was
started by the root user. You should change that ASAP. As you can see
in my example my httpd server was started by the apache user.
I hope this example helps.
Bottom line is that you can log into your server as root and you dont
have to stop the httpd server if the process or processes are owned by
the apache user.
Wayne
On Fri, 2004-07-09 at 11:42, Michael Sullivan wrote:
Can you clarify what "_RUN_ the web server" means? My
current practice
is this: The only way I work on my server PC is through ssh from a
client computer because my server PC doesn't have a monitor hooked up to
it. Anyway, I log in as root and the very first thing I do is "service
httpd stop". I go about doing whatever task I have to do in that
session and then I say, "service httpd start; exit". Are you saying
that I don't have to have Apache stopped while I'm logged in as root, or
are you saying I shouldn't stay logged in as root after I issue "service
httpd start"?
> Date: Thu, 8 Jul 2004 17:16:07 -0700 (PDT)
> From: Alan Horn <ahorn(a)deorth.org>
> Subject: Re: Working as root while Apache is running; how much a risk?
> To: For users of Fedora Core releases <fedora-list(a)redhat.com>
> Message-ID: <Pine.NEB.4.60.0407081714230.962(a)slick.sigje.org>
> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
>
>
>
> On Thu, 8 Jul 2004, Michael Sullivan wrote:
>
> > When I first started using Red Hat Linux 8.0 I was reading through
the
> > Red Hat Linux Security Guide and it said to always shut down Apache
when
> > logged in as root to prevent hackers from coming in through the web
> > server. I've always done it because the Security Guid said to, but
> > never really understood why. How would hackers come in through the
web
> > server? I realize that they could telnet in, but wouldn't they have
to
> > log in as a user? What exactly would happen? Can anyone tell me
how
> > this would be accomplished? It's annoying having to stop Apache
when I
> > log in to work on the system and then starting it again when I log
> > out...
>
> Um, I've never heard of that restriction. You should never _RUN_ the
> webserver as root (the same goes for any processes that interact with
the
> outside world where at all possible).
>
> Perhaps thats where the confusion comes from ?
>
> The reason for not running a webserver as root is that any method that
a
> hacker uses to compromise that webserver will then have a greater
level
> (e.g. root) of access into your system. read and modify any files,
trash
> your disks.. etc...
>
> Cheers,
>
> Al
>
>
>
>
> ------------------------------
________________________________________________________________________
Wayne Leutwyler, RHCT
Home Page
Feel the Power of the Penguin!
As long as there is breath in my body,
there will be a Penguin on my Desktop.
Home: 614-336-9668
Work: 614-410-7507
________________________________________________________________________
12:19 p.m.
New subject: web file permissions (was: Working as root while Apache is running; how much a risk?)
On Fri, Jul 09, 2004 at 12:47:15PM -0400, Wayne Leutwyler wrote:
Try this:
ps -ef | grep httpd
What you should see is something like below:
apache 10423 1125 0 04:02 ? 00:00:00 /usr/sbin/httpd
-DHAVE_ACCESS -D
apache 10424 1125 0 04:02 ? 00:00:00 /usr/sbin/httpd
-DHAVE_ACCESS -D
apache 10425 1125 0 04:02 ? 00:00:00 /usr/sbin/httpd
-DHAVE_ACCESS -D
apache 10426 1125 0 04:02 ? 00:00:00 /usr/sbin/httpd
-DHAVE_ACCESS -D
apache 10427 1125 0 04:02 ? 00:00:00 /usr/sbin/httpd
-DHAVE_ACCESS -D
apache 10428 1125 0 04:02 ? 00:00:00 /usr/sbin/httpd
-DHAVE_ACCESS -D
apache 10429 1125 0 04:02 ? 00:00:00 /usr/sbin/httpd
-DHAVE_ACCESS -D
apache 10430 1125 0 04:02 ? 00:00:00 /usr/sbin/httpd
-DHAVE_ACCESS -D
Now if you see root where apache is that means your httpd server was
started by the root user. You should change that ASAP. As you can see
in my example my httpd server was started by the apache user.
I hope this example helps.
Bottom line is that you can log into your server as root and you dont
have to stop the httpd server if the process or processes are owned by
the apache user.
Yes, this is heinous thread hijacking but it's at least tangentially related
to the former subject. What are the thoughts on permissions, including ownership, for
files and directories residing on a webserver? Should they all be apache, i.e., the same
owner as the running process? Or would that just make it easier for the perp to change
files if they managed to usurp the running process? Maybe a totally different unprivileged
user?
Myself, I make all my web files owned by nobody and the running process
owned by apache. All static files have 0400 permissions. Directories must
have 0755.
--
Jack Bowling
mailto: jbinpg(a)shaw.ca
2:48 p.m.
New subject: web file permissions (was: Working as root while Apache is running; how much a risk?)
Am Fr, den 09.07.2004 schrieb Jack Bowling um 19:19:
Yes, this is heinous thread hijacking but it's at least
tangentially related
to the former subject. What are the thoughts on permissions, including ownership, for
files and
directories residing on a webserver? Should they all be apache, i.e., the same owner as
the running
process? Or would that just make it easier for the perp to change files if they managed
to usurp the
running process? Maybe a totally different unprivileged user?
Speaking about the main server with DocumentRoot /var/www/html it is ok
to have files and directories owned root:root, files chmod 644 and dirs
chmod 755. For some applications like phpMyAdmin or Horde/IMP I am using
chown root:apache.
Myself, I make all my web files owned by nobody and the running
process
owned by apache. All static files have 0400 permissions. Directories must
have 0755.
That can't work. If the files are owned by nobody and only readable by
nobody, then user apache can't read the files for web serving.
Directories don't have to have 0755. If owner and group are different
than the user under which the Apache daemon is running, then for
other/world +x is enough. As an example, you have running a UserDir
configuration then the home of the users have to be chmod 0711 so that
apache can access the files under ~/public_html.
Jack Bowling
Alexander
--
Alexander Dalloz | Enger, Germany | GPG key 1024D/ED695653 1999-07-13
Fedora GNU/Linux Core 2 (Tettnang) on Athlon CPU kernel 2.6.6-1.435.2.3
Serendipity 21:41:47 up 2 days, 3:50, load average: 0.16, 0.46, 0.48
7234
days inactive
7235
days old
13 comments
9 participants
participants (9)
-
Alan Horn -
Alexander Dalloz -
Dave Pawson -
Jack Bowling -
Jeff Vian -
Jorge Fábregas -
Michael Sullivan -
Scot L. Harris -
Wayne Leutwyler