From owner-freebsd-questions@FreeBSD.ORG Thu Apr 29 12:02:47 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 95F4916A4CE for ; Thu, 29 Apr 2004 12:02:47 -0700 (PDT) Received: from smtpout.mac.com (smtpout.mac.com [17.250.248.88]) by mx1.FreeBSD.org (Postfix) with ESMTP id 843A043D41 for ; Thu, 29 Apr 2004 12:02:47 -0700 (PDT) (envelope-from cswiger@mac.com) Received: from mac.com (smtpin07-en2 [10.13.10.152]) by smtpout.mac.com (Xserve/MantshX 2.0) with ESMTP id i3TJ2log004668 for ; Thu, 29 Apr 2004 12:02:47 -0700 (PDT) Received: from [10.1.1.193] (nfw2.codefab.com [199.103.21.225] (may be forged)) (authenticated bits=0) by mac.com (Xserve/smtpin07/MantshX 3.0) with ESMTP id i3TJ2k3Z009457 for ; Thu, 29 Apr 2004 12:02:46 -0700 (PDT) Mime-Version: 1.0 (Apple Message framework v613) In-Reply-To: <6.0.0.22.0.20040429140657.11cf1120@pop.face2interface.com> References: <200404262126.36157.mikkel@talkactive.net> <200404291406.58150.mikkel@talkactive.net> <6.0.0.22.0.20040429101444.0e68a6a0@pop.face2interface.com> <200404291713.13999.mikkel@talkactive.net> <6.0.0.22.0.20040429140657.11cf1120@pop.face2interface.com> Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit Cc: FreeBSD-questions Questions From: Charles Swiger Date: Thu, 29 Apr 2004 15:02:41 -0400 X-Mailer: Apple Mail (2.613) Subject: Re: Suexec with Apache 1.3.29 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Apr 2004 19:02:47 -0000 On Apr 29, 2004, at 2:20 PM, Marty Landman wrote: >> Now he has to give the webserver the same rights as everybody else on >> the server. > > Real new to this as said, but the consistency of the approach seems to > be that Apache itself runs as user nobody. So your argument may have > merit but only if carried over to argue that httpd should run as > something greater than the lowly 'nobody'. I would argue that no file and no process on a system ought to be running as nobody. FreeBSD ships with a www user, uid=80, which is a much better choice to run Apache as. It's entirely possible to set up web-driven services which interact with Apache running as www, which in turn have their own uid's and permissions, such as Mailman, Big Brother, WebObjects, and lots of other "web middleware". -- -Chuck