Date: Thu, 09 Apr 2015 15:26:32 +0200 From: Mark Martinec <Mark.Martinec+freebsd@ijs.si> To: freebsd-ports@freebsd.org Subject: Re: is it safe to run net/haproxy as root? Message-ID: <f833db9e029a6efa808e5b00106f1d06@mailbox.ijs.si> In-Reply-To: <20150409114426.0081485b@efreet> References: <20150409114426.0081485b@efreet>
next in thread | previous in thread | raw e-mail | index | archive | help
Marko Cupa=C4=87 wrote:
> I am setting up haproxy for the first time, and of course my first OS
> choice is FreeBSD.
>=20
> Most services I am familiar with use their own service accounts which
> are created when port is installed (squid, ejabberd, mysql, clamav,
> vscan etc.). But haproxy does not create account, and there is no
> pkg-message, or any other reference which suggests I should create
> separate account, and also whether it needs shell, homedir etc. On the
> other hand, most web 'works for me' howtos mention running it under
> separate account.
>=20
> So, my question is the one from this mail's subject:
> Is it safe to run haproxy under root account? If not, what is the best
> practice regarding its user account's shell and homedir? Is there a
> recommendation for UID/GID?
It might be safe, but there is no compelling reason to run it as root,
and a common sense advises against it. Even if it needs to bind
to a low port number, haproxy is capable of dropping privilege after
binding to a socket, and continues running under some other uid/gid,
e.g.:
/usr/local/etc/haproxy.conf
global
daemon
user www
group www
[...]
Apparently there isn't any standard FreeBSD uid assigned for
this purpose. Either make up one, or it may be good enough
to re-use one of the existing ones, perhaps the www account.
Perhaps the haproxy port maintainer can be persuaded to assign
some account entry for this purpose.
Mark
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?f833db9e029a6efa808e5b00106f1d06>