Groups > linux.debian.user > #201824

Re: www-data

Path	csiph.com!2.eu.feeder.erje.net!feeder.erje.net!1.eu.feeder.erje.net!news2.arglkargh.de!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod
From	Ben Caradoc-Davies <ben@transient.nz>
Newsgroups	linux.debian.user
Subject	Re: www-data
Date	Mon, 29 Oct 2018 00:10:01 +0100
Message-ID	<wO2lX-3oO-9@gated-at.bofh.it> (permalink)
References	<wO0Dx-2lb-27@gated-at.bofh.it> <wO0Nc-2oh-3@gated-at.bofh.it> <wO16x-2us-3@gated-at.bofh.it> <wO22B-332-9@gated-at.bofh.it>
X-Original-To	debian-user@lists.debian.org
X-Mailbox-Line	From debian-user-request@lists.debian.org Sun Oct 28 23:03:23 2018
Old-Return-Path	<ben@transient.nz>
X-Amavis-Spam-Status	No, score=-3.8 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, LDO_WHITELIST=-5, ONEWORD=2, RCVD_IN_DNSWL_NONE=-0.0001, WEBMAIL=1] autolearn=no autolearn_force=no
X-Policyd-Weight	using cached result; rate:hard: -6.1
Dkim-Signature	v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=transient.nz; s=default; h=Content-Transfer-Encoding:Content-Type: In-Reply-To:MIME-Version:Date:Message-ID:From:References:To:Subject:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help: List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=X+6sEXql4q31cYRnDaZuK/Lp3epcFOqTHDueNNT4pAA=; b=ZXH2RBqfxRBv34HtU03DbWQmnC MRBqJ0BmfPHY15Z3dn5P7r2JfTySfd4Mre6US/56CYlxJV+HrHshmE3x5uPEOliOuJJ2G1riLHxky yWG7qBEE/uW6uLJhnlXv6fdUGj3bvbytSNxBa+UhYJSMU2dsm3mcQjfXcdSb/GpQWceM=;
User-Agent	Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.2.1
MIME-Version	1.0
Content-Type	text/plain; charset=utf-8; format=flowed
Content-Language	en-GB
Content-Transfer-Encoding	7bit
X-Outgoing-Spam-Status	No, score=-0.2
X-Antiabuse	This header was added to track abuse, please include it with any abuse report
X-Antiabuse	Primary Hostname - skyhawk.mysecure.co.nz
X-Antiabuse	Original Domain - lists.debian.org
X-Antiabuse	Originator/Caller UID/GID - [47 12] / [47 12]
X-Antiabuse	Sender Address Domain - transient.nz
X-Get-Message-Sender-Via	skyhawk.mysecure.co.nz: authenticated_id: ben@transient.nz
X-Authenticated-Sender	skyhawk.mysecure.co.nz: ben@transient.nz
X-Mailing-List	<debian-user@lists.debian.org> archive/latest/741785
List-ID	<debian-user.lists.debian.org>
List-URL	<https://lists.debian.org/debian-user/>
List-Archive	https://lists.debian.org/msgid-search/1a9458cc-1441-19c3-f11d-e2c743799ba9@transient.nz
Approved	robomod@news.nic.it
Lines	26
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Date	Mon, 29 Oct 2018 12:02:57 +1300
X-Original-Message-ID	<1a9458cc-1441-19c3-f11d-e2c743799ba9@transient.nz>
X-Original-References	<8ce2d0af5847844a7f6831490166e473@gmail.com> <b5abdea7-7188-ba7f-cf71-a4bbb6991458@panix.com> <9c804d76-08d1-1840-22c2-cb5a64f23db7@transient.nz> <086231bd50b4cecf2fbbcf20b3cdf11d@gmail.com>
Xref	csiph.com linux.debian.user:201824

Show key headers only | View raw

On 29/10/2018 11:42, mick crane wrote:
> I'm asking because somebody is saying that webmail server files should 
> be owned by root but I don't know about that, if somebody as got so far 
> to be www-data they might as well be root ?

Web server configuration files are typically owned by root and not 
writeable by other users. Files containing secrets such a private keys 
may only be readable by root. When a server is started as root, it reads 
its configuration files and secrets, then drops privileges by changing 
user. During normal operation as an unprivileged user, the server cannot 
edit its own configuration files or write where access has not been 
granted to www-data. This provides a substantial level of protection 
that is absent in a server running as root. Apache can also be used as a 
proxy for other services such as Tomcat, providing an additional layer 
of protection.

The specific case of webmail likely requires read-write access to user 
mailboxes. I do not know how privilege separation is handled in this case.

Kind regards,

-- 
Ben Caradoc-Davies <ben@transient.nz>
Director
Transient Software Limited <https://transient.nz/>
New Zealand

Thread

www-data mick crane <mick.crane@gmail.com> - 2018-10-28 22:20 +0100
  Re: www-data Carl Fink <carlf@panix.com> - 2018-10-28 22:30 +0100
    Re: www-data Ben Caradoc-Davies <ben@transient.nz> - 2018-10-28 22:50 +0100
      Re: www-data mick crane <mick.crane@gmail.com> - 2018-10-28 23:50 +0100
        Re: www-data Ben Caradoc-Davies <ben@transient.nz> - 2018-10-29 00:10 +0100
        Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-29 01:00 +0100
          Re: www-data David Wright <deblis@lionunicorn.co.uk> - 2018-10-29 18:30 +0100
            Re: www-data Michael Stone <mstone@debian.org> - 2018-10-29 20:30 +0100
          Re: www-data Jonathan Dowland <jmtd@debian.org> - 2018-10-30 11:20 +0100
            Re: www-data Curt <curty@free.fr> - 2018-10-30 11:50 +0100
            Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-30 14:30 +0100
              Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-30 14:40 +0100
                Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-30 15:30 +0100
              Re: www-data Martin <keine-eile@online.de> - 2018-10-30 15:10 +0100
              Re: www-data Jonathan Dowland <jmtd@debian.org> - 2018-11-01 13:00 +0100
                Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-11-01 16:40 +0100
          Re: www-data mick crane <mick.crane@gmail.com> - 2018-10-31 21:00 +0100
    Re: www-data Ben Caradoc-Davies <ben@transient.nz> - 2018-10-28 23:00 +0100

csiph-web