Apache start issue

rs266 · #1 (**permalink**) 08-21-2008

Hi group,

I need help to start apache in following scenario:

1) Say apache is installed on solaris OS by user 'root'.
2) An entry is there in httpd.conf that says to start apache process as user:
#User <RUN_AS_USER> is edited as
User user1
2) Now say user2 has logged and tries to start apache process. Now whosoever tries to start Apache, it should always gets start as user1.

We are only able to start apache as a 'root' user.

Thanks
rs266

Neo · #2 (**permalink**) 08-21-2008

User2 cannot start a process as User1, this would be a security violation.

You have to start the process as either User1 or root.....

rs266 · #3 (**permalink**) 08-21-2008

then what is the usage of
#User <RUN_AS_USER> in httpd.conf.

Please explain a bit details for this.

indo1144 · #4 (**permalink**) 08-21-2008

The reason that directive exist, is that only the apache-processes that serve out pages run as a different user. Did you notice that one process always runs as root (when started as root)? The other child-processes run as a different user.
When there is a compromise of your system, the intruder will have the privileges of the apache-user and not root. Always make sure that your apache-user has no more rights than it needs...

Quote:

Originally Posted by rs266

then what is the usage of
#User <RUN_AS_USER> in httpd.conf.

Please explain a bit details for this.

pupp · #5 (**permalink**) 08-21-2008

it might be a little easier to understand with this:
httpd.conf

Code:

#
# If you wish httpd to run as a different user or group, you must run
# httpd as root initially and it will switch.
#
# User/Group: The name (or #number) of the user/group to run httpd as.
# It is usually good practice to create a dedicated user and group for
# running httpd, as with most system services.
#
User www
Group www

now each child process is user www

Code:

# ps -eaf | grep httpd
     www  3903  3900   0   Aug 11 ?           0:00 /usr/local/apache2/bin/httpd -k start
     www  4520  3901   0   Aug 19 ?           0:52 /usr/local/apache2/bin/httpd -k start
     www  4519  3901   0   Aug 19 ?           0:59 /usr/local/apache2/bin/httpd -k start
     www  4597  3901   0 21:26:11 ?           0:11 /usr/local/apache2/bin/httpd -k start
     www  3909  3900   0   Aug 11 ?           0:00 /usr/local/apache2/bin/httpd -k start
     www  3911  3900   0   Aug 11 ?           0:00 /usr/local/apache2/bin/httpd -k start
    root  3901     1   0   Aug 11 ?           1:41 /usr/local/apache2/bin/httpd -k start
     www  4512  3901   0   Aug 19 ?           0:46 /usr/local/apache2/bin/httpd -k start

otheus · #6 (**permalink**) 08-21-2008

That's correct. Only processes launched as the 'root' user may change the user to something else (Which is what Apache is trying to do with that configuration line.) In order to start Apache in such a way, you need to use something like the "sudo" package. In the sudoers configuration file, you might add a line like this:

Code:

user2   ALL=(user1) /opt/CSWApache/bin/apachectl

This says that user2 can now run (at the shell):

Code:

$ sudo -u user1 /opt/CSWApache/bin/apachectl start

otheus · #7 (**permalink**) 08-21-2008

That's the user apache will run Apache child processes under. This only works if 'root' starts the Apache process.

More UNIX and Linux Forum Topics You Might Find Helpful
Thread	Thread Starter	Forum	Replies	Last Post
help me........... my apache can't start	yatmianto	SUN Solaris	5	04-13-2008 11:19 PM
Apache start problem	maheshsri	SUN Solaris	1	03-13-2006 06:07 AM
Start Stop Apache	MILLERJ62	AIX	2	12-27-2005 05:40 PM
Apache start (Was in:how can i?) [Split by LF]	donohd	UNIX for Dummies Questions & Answers	1	03-19-2002 05:54 AM
Apache wont start	Alpha_Harblo	UNIX for Dummies Questions & Answers	4	01-02-2002 09:26 PM

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes	Rate This Thread
Switch to Linear Mode Hybrid Mode Switch to Threaded Mode	Rate This Thread:


	Powered by