Thread: [Devil-linux-develop] [ devil-linux-Bugs-826071 ] apache security

Brought to you by: blubdog, friedl, small_fish, smiley73

devil-linux-develop

[Devil-linux-develop] [ devil-linux-Bugs-826071 ] apache security

From: SourceForge.net <no...@so...> - 2003-10-19 10:32:53

Bugs item #826071, was opened at 2003-10-18 13:30
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410643&aid=826071&group_id=34096

Category: Package
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: Heiko Zuerker (smiley73)
Assigned to: Nobody/Anonymous (nobody)
Summary: apache security

Initial Comment:
apache still runs as root, this needs to be fixed

can we get a common usable chroot working?
(could be a problem with all the libs we need)

anything else we can do?


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410643&aid=826071&group_id=34096

[Devil-linux-develop] [ devil-linux-Bugs-826071 ] apache security

From: SourceForge.net <no...@so...> - 2003-10-19 13:22:28

Bugs item #826071, was opened at 2003-10-18 14:30
Message generated for change (Comment added) made by blubdog
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410643&aid=826071&group_id=34096

Category: Package
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: Heiko Zuerker (smiley73)
Assigned to: Nobody/Anonymous (nobody)
Summary: apache security

Initial Comment:
apache still runs as root, this needs to be fixed

can we get a common usable chroot working?
(could be a problem with all the libs we need)

anything else we can do?


----------------------------------------------------------------------

>Comment By: Bruce Smith (blubdog)
Date: 2003-10-19 09:01

Message:
Logged In: YES 
user_id=778609

We should also create a logical volume for hard drive
storage of the home/data/web-site:  /var/www


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410643&aid=826071&group_id=34096

[Devil-linux-develop] [ devil-linux-Bugs-826071 ] apache security

From: SourceForge.net <no...@so...> - 2003-10-21 17:32:30

Bugs item #826071, was opened at 2003-10-18 13:30
Message generated for change (Comment added) made by smiley73
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410643&aid=826071&group_id=34096

Category: Package
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: Heiko Zuerker (smiley73)
Assigned to: Nobody/Anonymous (nobody)
Summary: apache security

Initial Comment:
apache still runs as root, this needs to be fixed

can we get a common usable chroot working?
(could be a problem with all the libs we need)

anything else we can do?


----------------------------------------------------------------------

>Comment By: Heiko Zuerker (smiley73)
Date: 2003-10-21 11:46

Message:
Logged In: YES 
user_id=112133

remove the "user nobody" part and add
user www
group www

to /etc/apache2/httpd.conf

----------------------------------------------------------------------

Comment By: Bruce Smith (blubdog)
Date: 2003-10-19 08:01

Message:
Logged In: YES 
user_id=778609

We should also create a logical volume for hard drive
storage of the home/data/web-site:  /var/www


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410643&aid=826071&group_id=34096

[Devil-linux-develop] [ devil-linux-Bugs-826071 ] apache security

From: SourceForge.net <no...@so...> - 2003-12-20 02:15:53

Bugs item #826071, was opened at 2003-10-18 13:30
Message generated for change (Settings changed) made by smiley73
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410643&aid=826071&group_id=34096

Category: Package
Group: None
>Status: Deleted
>Resolution: Works For Me
Priority: 5
Submitted By: Heiko Zuerker (smiley73)
>Assigned to: Heiko Zuerker (smiley73)
Summary: apache security

Initial Comment:
apache still runs as root, this needs to be fixed

can we get a common usable chroot working?
(could be a problem with all the libs we need)

anything else we can do?


----------------------------------------------------------------------

Comment By: Heiko Zuerker (smiley73)
Date: 2003-10-21 11:46

Message:
Logged In: YES 
user_id=112133

remove the "user nobody" part and add
user www
group www

to /etc/apache2/httpd.conf

----------------------------------------------------------------------

Comment By: Bruce Smith (blubdog)
Date: 2003-10-19 08:01

Message:
Logged In: YES 
user_id=778609

We should also create a logical volume for hard drive
storage of the home/data/web-site:  /var/www


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=410643&aid=826071&group_id=34096

Re: [Devil-linux-develop] [ devil-linux-Bugs-826071 ] apache security

From: Bruce S. <bw...@ar...> - 2003-10-19 12:59:45

> Initial Comment:
> apache still runs as root, this needs to be fixed

Yes, should be user and group "apache".

> can we get a common usable chroot working?
> (could be a problem with all the libs we need)

The "home" (data) could be a problem too.
It may not fit into a ram disk.
May not be worth it ...

> anything else we can do?

Should probably create a logical volume for hard drive
storage of the data.   /var/www/

 - BS

Re: [Devil-linux-develop] [ devil-linux-Bugs-826071 ] apache security

From: Heiko Z. <he...@zu...> - 2003-10-20 01:24:35

Bruce Smith wrote:

>>Initial Comment:
>>apache still runs as root, this needs to be fixed
>>    
>>
>
>Yes, should be user and group "apache".
>
user and group www
Those are already existing in DL.

>>can we get a common usable chroot working?
>>(could be a problem with all the libs we need)
>>    
>>
>
>The "home" (data) could be a problem too.
>It may not fit into a ram disk.
>May not be worth it ...
>
>  
>
>>anything else we can do?
>>    
>>
>
>Should probably create a logical volume for hard drive
>storage of the data.   /var/www/
>  
>
I think that's more a problem if the administrator.

cya
  Heiko

Re: [Devil-linux-develop] [ devil-linux-Bugs-826071 ] apache security

From: Bruce S. <bw...@ar...> - 2003-10-20 15:53:24

> >>apache still runs as root, this needs to be fixed
> >
> >Yes, should be user and group "apache".
> >
> user and group www
> Those are already existing in DL.

OK, most other distros use "apache", but it doesn't really matter.
I think all that is required is a couple lines in the config file:

User www
Group www

> >Should probably create a logical volume for hard drive
> >storage of the data.   /var/www/
> >
> I think that's more a problem if the administrator.

Huh?  I'm not following you (or maybe you're not following me? :)

I'm talking about creating a LV name to store the Apache web site.
http://www.devil-linux.org/newdoc/ch01s04.html#d0e568

Do you want to reuse one of other names, like /var/data ?

Most distros store it in /var/www .

 - BS