Path: csiph.com!2.eu.feeder.erje.net!feeder.erje.net!1.eu.feeder.erje.net!news2.arglkargh.de!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod From: Ben Caradoc-Davies Newsgroups: linux.debian.user Subject: Re: www-data Date: Mon, 29 Oct 2018 00:10:01 +0100 Message-ID: References: X-Original-To: debian-user@lists.debian.org X-Mailbox-Line: From debian-user-request@lists.debian.org Sun Oct 28 23:03:23 2018 Old-Return-Path: X-Amavis-Spam-Status: No, score=-3.8 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, LDO_WHITELIST=-5, ONEWORD=2, RCVD_IN_DNSWL_NONE=-0.0001, WEBMAIL=1] autolearn=no autolearn_force=no X-Policyd-Weight: using cached result; rate:hard: -6.1 Dkim-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=transient.nz; s=default; h=Content-Transfer-Encoding:Content-Type: In-Reply-To:MIME-Version:Date:Message-ID:From:References:To:Subject:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help: List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=X+6sEXql4q31cYRnDaZuK/Lp3epcFOqTHDueNNT4pAA=; b=ZXH2RBqfxRBv34HtU03DbWQmnC MRBqJ0BmfPHY15Z3dn5P7r2JfTySfd4Mre6US/56CYlxJV+HrHshmE3x5uPEOliOuJJ2G1riLHxky yWG7qBEE/uW6uLJhnlXv6fdUGj3bvbytSNxBa+UhYJSMU2dsm3mcQjfXcdSb/GpQWceM=; User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.2.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit X-Outgoing-Spam-Status: No, score=-0.2 X-Antiabuse: This header was added to track abuse, please include it with any abuse report X-Antiabuse: Primary Hostname - skyhawk.mysecure.co.nz X-Antiabuse: Original Domain - lists.debian.org X-Antiabuse: Originator/Caller UID/GID - [47 12] / [47 12] X-Antiabuse: Sender Address Domain - transient.nz X-Get-Message-Sender-Via: skyhawk.mysecure.co.nz: authenticated_id: ben@transient.nz X-Authenticated-Sender: skyhawk.mysecure.co.nz: ben@transient.nz X-Mailing-List: archive/latest/741785 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/1a9458cc-1441-19c3-f11d-e2c743799ba9@transient.nz Approved: robomod@news.nic.it Lines: 26 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Mon, 29 Oct 2018 12:02:57 +1300 X-Original-Message-ID: <1a9458cc-1441-19c3-f11d-e2c743799ba9@transient.nz> X-Original-References: <8ce2d0af5847844a7f6831490166e473@gmail.com> <9c804d76-08d1-1840-22c2-cb5a64f23db7@transient.nz> <086231bd50b4cecf2fbbcf20b3cdf11d@gmail.com> Xref: csiph.com linux.debian.user:201824 On 29/10/2018 11:42, mick crane wrote: > I'm asking because somebody is saying that webmail server files should > be owned by root but I don't know about that, if somebody as got so far > to be www-data they might as well be root ? Web server configuration files are typically owned by root and not writeable by other users. Files containing secrets such a private keys may only be readable by root. When a server is started as root, it reads its configuration files and secrets, then drops privileges by changing user. During normal operation as an unprivileged user, the server cannot edit its own configuration files or write where access has not been granted to www-data. This provides a substantial level of protection that is absent in a server running as root. Apache can also be used as a proxy for other services such as Tomcat, providing an additional layer of protection. The specific case of webmail likely requires read-write access to user mailboxes. I do not know how privilege separation is handled in this case. Kind regards, -- Ben Caradoc-Davies Director Transient Software Limited New Zealand