Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #201824

Re: www-data

Show all headers | View raw

On 29/10/2018 11:42, mick crane wrote:
> I'm asking because somebody is saying that webmail server files should 
> be owned by root but I don't know about that, if somebody as got so far 
> to be www-data they might as well be root ?

Web server configuration files are typically owned by root and not 
writeable by other users. Files containing secrets such a private keys 
may only be readable by root. When a server is started as root, it reads 
its configuration files and secrets, then drops privileges by changing 
user. During normal operation as an unprivileged user, the server cannot 
edit its own configuration files or write where access has not been 
granted to www-data. This provides a substantial level of protection 
that is absent in a server running as root. Apache can also be used as a 
proxy for other services such as Tomcat, providing an additional layer 
of protection.

The specific case of webmail likely requires read-write access to user 
mailboxes. I do not know how privilege separation is handled in this case.

Kind regards,

-- 
Ben Caradoc-Davies <ben@transient.nz>
Director
Transient Software Limited <https://transient.nz/>
New Zealand

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

www-data mick crane <mick.crane@gmail.com> - 2018-10-28 22:20 +0100
  Re: www-data Carl Fink <carlf@panix.com> - 2018-10-28 22:30 +0100
    Re: www-data Ben Caradoc-Davies <ben@transient.nz> - 2018-10-28 22:50 +0100
      Re: www-data mick crane <mick.crane@gmail.com> - 2018-10-28 23:50 +0100
        Re: www-data Ben Caradoc-Davies <ben@transient.nz> - 2018-10-29 00:10 +0100
        Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-29 01:00 +0100
          Re: www-data David Wright <deblis@lionunicorn.co.uk> - 2018-10-29 18:30 +0100
            Re: www-data Michael Stone <mstone@debian.org> - 2018-10-29 20:30 +0100
          Re: www-data Jonathan Dowland <jmtd@debian.org> - 2018-10-30 11:20 +0100
            Re: www-data Curt <curty@free.fr> - 2018-10-30 11:50 +0100
            Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-30 14:30 +0100
              Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-30 14:40 +0100
                Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-30 15:30 +0100
              Re: www-data Martin <keine-eile@online.de> - 2018-10-30 15:10 +0100
              Re: www-data Jonathan Dowland <jmtd@debian.org> - 2018-11-01 13:00 +0100
                Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-11-01 16:40 +0100
          Re: www-data mick crane <mick.crane@gmail.com> - 2018-10-31 21:00 +0100
    Re: www-data Ben Caradoc-Davies <ben@transient.nz> - 2018-10-28 23:00 +0100

csiph-web