Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #201818 > unrolled thread

www-data

Back to article view | Back to linux.debian.user

Contents

  www-data mick crane <mick.crane@gmail.com> - 2018-10-28 22:20 +0100
    Re: www-data Carl Fink <carlf@panix.com> - 2018-10-28 22:30 +0100
      Re: www-data Ben Caradoc-Davies <ben@transient.nz> - 2018-10-28 22:50 +0100
        Re: www-data mick crane <mick.crane@gmail.com> - 2018-10-28 23:50 +0100
          Re: www-data Ben Caradoc-Davies <ben@transient.nz> - 2018-10-29 00:10 +0100
          Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-29 01:00 +0100
            Re: www-data David Wright <deblis@lionunicorn.co.uk> - 2018-10-29 18:30 +0100
              Re: www-data Michael Stone <mstone@debian.org> - 2018-10-29 20:30 +0100
            Re: www-data Jonathan Dowland <jmtd@debian.org> - 2018-10-30 11:20 +0100
              Re: www-data Curt <curty@free.fr> - 2018-10-30 11:50 +0100
              Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-30 14:30 +0100
                Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-30 14:40 +0100
                  Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-30 15:30 +0100
                Re: www-data Martin <keine-eile@online.de> - 2018-10-30 15:10 +0100
                Re: www-data Jonathan Dowland <jmtd@debian.org> - 2018-11-01 13:00 +0100
                  Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-11-01 16:40 +0100
            Re: www-data mick crane <mick.crane@gmail.com> - 2018-10-31 21:00 +0100
      Re: www-data Ben Caradoc-Davies <ben@transient.nz> - 2018-10-28 23:00 +0100

#201818 — www-data

what's the deal with www-data ?
I never made that user
I dunno if it has a password or what ?
these are things that some setup / install makes ?

mick


-- 
Key ID    4BFEBB31

[toc] | [next] | [standalone]

#201819

On 10/28/2018 05:16 PM, mick crane wrote:
> what's the deal with www-data ?
> I never made that user
> I dunno if it has a password or what ?
> these are things that some setup / install makes ?
>
> mick
>
>
It's created by the Apache installer. Check the Apache docs.

-- 
Carl Fink          carl@finknetwork.com
Thinking and logic and stuff at Reasonably Literate
http://reasonablyliterate.com

[toc] | [prev] | [next] | [standalone]

#201820

On 29/10/2018 10:26, Carl Fink wrote:
> On 10/28/2018 05:16 PM, mick crane wrote:
>> what's the deal with www-data ?
>> I never made that user
>> I dunno if it has a password or what ?
>> these are things that some setup / install makes ?
> It's created by the Apache installer. Check the Apache docs.

And it should have no password. This user is accessed by switching to it 
from root. As a security measure, after binding to privileged network 
ports as root, apache switches to user www-data so that, if it is 
compromised, the damage is limited. Processes that have dropped root 
privileges cannot automatically regain them. Postgres and Tomcat do the 
same thing with their own dedicated users.

Kind regards,

-- 
Ben Caradoc-Davies <ben@transient.nz>
Director
Transient Software Limited <https://transient.nz/>
New Zealand

[toc] | [prev] | [next] | [standalone]

#201823

On 2018-10-28 21:38, Ben Caradoc-Davies wrote:
> On 29/10/2018 10:26, Carl Fink wrote:
>> On 10/28/2018 05:16 PM, mick crane wrote:
>>> what's the deal with www-data ?
>>> I never made that user
>>> I dunno if it has a password or what ?
>>> these are things that some setup / install makes ?
>> It's created by the Apache installer. Check the Apache docs.
> 
> And it should have no password. This user is accessed by switching to
> it from root. As a security measure, after binding to privileged
> network ports as root, apache switches to user www-data so that, if it
> is compromised, the damage is limited. Processes that have dropped
> root privileges cannot automatically regain them. Postgres and Tomcat
> do the same thing with their own dedicated users.

I'm asking because somebody is saying that webmail server files should 
be owned by root but I don't know about that, if somebody as got so far 
to be www-data they might as well be root ?

mick


-- 
Key ID    4BFEBB31

[toc] | [prev] | [next] | [standalone]

#201824

On 29/10/2018 11:42, mick crane wrote:
> I'm asking because somebody is saying that webmail server files should 
> be owned by root but I don't know about that, if somebody as got so far 
> to be www-data they might as well be root ?

Web server configuration files are typically owned by root and not 
writeable by other users. Files containing secrets such a private keys 
may only be readable by root. When a server is started as root, it reads 
its configuration files and secrets, then drops privileges by changing 
user. During normal operation as an unprivileged user, the server cannot 
edit its own configuration files or write where access has not been 
granted to www-data. This provides a substantial level of protection 
that is absent in a server running as root. Apache can also be used as a 
proxy for other services such as Tomcat, providing an additional layer 
of protection.

The specific case of webmail likely requires read-write access to user 
mailboxes. I do not know how privilege separation is handled in this case.

Kind regards,

-- 
Ben Caradoc-Davies <ben@transient.nz>
Director
Transient Software Limited <https://transient.nz/>
New Zealand

[toc] | [prev] | [next] | [standalone]

#201826

On Sunday 28 October 2018 18:42:41 mick crane wrote:

> On 2018-10-28 21:38, Ben Caradoc-Davies wrote:
> > On 29/10/2018 10:26, Carl Fink wrote:
> >> On 10/28/2018 05:16 PM, mick crane wrote:
> >>> what's the deal with www-data ?
> >>> I never made that user
> >>> I dunno if it has a password or what ?
> >>> these are things that some setup / install makes ?
> >>
> >> It's created by the Apache installer. Check the Apache docs.
> >
> > And it should have no password. This user is accessed by switching
> > to it from root. As a security measure, after binding to privileged
> > network ports as root, apache switches to user www-data so that, if
> > it is compromised, the damage is limited. Processes that have
> > dropped root privileges cannot automatically regain them. Postgres
> > and Tomcat do the same thing with their own dedicated users.
>
> I'm asking because somebody is saying that webmail server files should
> be owned by root but I don't know about that, if somebody as got so
> far to be www-data they might as well be root ?
>
> mick

I don't think thats how it works. UID/GID as www-data is just part of the 
sandbox apache2 and its ilk play in. In fact after I've equipt apach2 
with some new toy, the last thing I do as root is a chown -R 
www-data:www-data any directory apache2 can access in going about its 
normal business.

Thats how IUI, and no one accessing my web page (its on this  machine) 
has jumped the sandbox fence in around 15 years now.

-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#201846

On Sun 28 Oct 2018 at 19:57:08 (-0400), Gene Heskett wrote:
> On Sunday 28 October 2018 18:42:41 mick crane wrote:
> > On 2018-10-28 21:38, Ben Caradoc-Davies wrote:
> > > On 29/10/2018 10:26, Carl Fink wrote:
> > >> On 10/28/2018 05:16 PM, mick crane wrote:
> > >>> what's the deal with www-data ?
> > >>> I never made that user
> > >>> I dunno if it has a password or what ?
> > >>> these are things that some setup / install makes ?

If you are merely alarmed, perhaps read
/usr/share/doc/base-passwd/users-and-groups.txt.gz
where you'll see that user/group 33 is reserved for this user.

> > >> It's created by the Apache installer. Check the Apache docs.

… but bear in mind that you don't have to install apache for
that user/group to be created on your system.

> > > And it should have no password. This user is accessed by switching
> > > to it from root. As a security measure, after binding to privileged
> > > network ports as root, apache switches to user www-data so that, if
> > > it is compromised, the damage is limited. Processes that have
> > > dropped root privileges cannot automatically regain them. Postgres
> > > and Tomcat do the same thing with their own dedicated users.
> >
> > I'm asking because somebody is saying that webmail server files should
> > be owned by root but I don't know about that, if somebody as got so
> > far to be www-data they might as well be root ?

Then you probably need to read the docs carefully, rather than taking
any notice of what's written below, which contradicts anything I've
read on this subject.

> I don't think thats how it works. UID/GID as www-data is just part of the 
> sandbox apache2 and its ilk play in. In fact after I've equipt apach2 
> with some new toy, the last thing I do as root is a chown -R 
> www-data:www-data any directory apache2 can access in going about its 
> normal business.
> 
> Thats how IUI, and no one accessing my web page (its on this  machine) 
> has jumped the sandbox fence in around 15 years now.

Why would they bother.

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#201847

On Mon, Oct 29, 2018 at 12:27:53PM -0500, David Wright wrote:
>On Sun 28 Oct 2018 at 19:57:08 (-0400), Gene Heskett wrote:
>> I don't think thats how it works. UID/GID as www-data is just part of the
>> sandbox apache2 and its ilk play in. In fact after I've equipt apach2
>> with some new toy, the last thing I do as root is a chown -R
>> www-data:www-data any directory apache2 can access in going about its
>> normal business.
>
>Then you probably need to read the docs carefully, rather than taking
>any notice of what's written [above], which contradicts anything I've
>read on this subject.

Correct; the original text is bad advice. In general, you do not want 
your web server process to be able to write the files that it is 
running, in order to reduce the avenues for privilege escalation in the 
face of a bug in a web script. Sometimes the web server does need to be 
able to write, and in those cases it is best to carefully configure the 
web server to not run anything from areas which are writable, and to 
restrict the writable areas to the minimum necessary. (A lot of other 
controls are also important, such as preventing unauthenticated upload 
and download of the same files and/or implementing some sort of 
moderation to prevent the site from turning into an unexpected 
distribution node for illegal material, etc.) 

Mike Stone

[toc] | [prev] | [next] | [standalone]

#201864

On Sun, Oct 28, 2018 at 07:57:08PM -0400, Gene Heskett wrote:
>Thats how IUI,

what does IUI mean? It doesn't look like any of these acronyms apply

https://www.acronymfinder.com/IUI.html

> and no one accessing my web page (its on this  machine)
>has jumped the sandbox fence in around 15 years now.

That you are aware of :)

[toc] | [prev] | [next] | [standalone]

#201868

On 2018-10-30, Jonathan Dowland <jmtd@debian.org> wrote:
> On Sun, Oct 28, 2018 at 07:57:08PM -0400, Gene Heskett wrote:
>>Thats how IUI,
>
> what does IUI mean? It doesn't look like any of these acronyms apply
>
> https://www.acronymfinder.com/IUI.html
>

As I understand it, we make them up as we go along (hypothetical foray
contained within).

MIUIW.

-- 
"Now she understood that Anna could not have been in lilac, and that her charm
was just that she always stood out against her attire, that her dress could
never be noticeable on her." Leo Tolstoy, Anna Karenina 

[toc] | [prev] | [next] | [standalone]

#201873

On Tuesday 30 October 2018 06:15:28 Jonathan Dowland wrote:

> On Sun, Oct 28, 2018 at 07:57:08PM -0400, Gene Heskett wrote:
> >Thats how IUI,
>
> what does IUI mean? It doesn't look like any of these acronyms apply
>
I Understand It.

> https://www.acronymfinder.com/IUI.html
>
> > and no one accessing my web page (its on this  machine)
> >has jumped the sandbox fence in around 15 years now.
>
> That you are aware of :)

That may be. Right now I see something from the php cleanup spamming my 
logs.  Is anyone else see it, something cron is running several times a 
day, but which can't be found by htop. So apparently it goes away when 
its done.  And AFAIK, nothings running thats php5 related.

Looking around, it appears the /var/log/httpd directory is missing so 
that log is being redirected to the syslog. A logrotate missfire?


-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#201876

On Tuesday 30 October 2018 09:24:25 Gene Heskett wrote:

> On Tuesday 30 October 2018 06:15:28 Jonathan Dowland wrote:
> > On Sun, Oct 28, 2018 at 07:57:08PM -0400, Gene Heskett wrote:
> > >Thats how IUI,
> >
> > what does IUI mean? It doesn't look like any of these acronyms apply
>
> I Understand It.
>
> > https://www.acronymfinder.com/IUI.html
> >
> > > and no one accessing my web page (its on this  machine)
> > >has jumped the sandbox fence in around 15 years now.
> >
> > That you are aware of :)
>
> That may be. Right now I see something from the php cleanup spamming
> my logs.  Is anyone else see it, something cron is running several
> times a day, but which can't be found by htop. So apparently it goes
> away when its done.  And AFAIK, nothings running thats php5 related.
>
> Looking around, it appears the /var/log/httpd directory is missing so
> that log is being redirected to the syslog. A logrotate missfire?
And I find an apache2 related script missing in /etc/logrotate.d
called httpd-prerotate, but its not there.  $me goes wandering off in 
search of some caffeine.

-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#201882

On Tuesday 30 October 2018 09:33:09 Gene Heskett wrote:

> On Tuesday 30 October 2018 09:24:25 Gene Heskett wrote:
> > On Tuesday 30 October 2018 06:15:28 Jonathan Dowland wrote:
> > > On Sun, Oct 28, 2018 at 07:57:08PM -0400, Gene Heskett wrote:
> > > >Thats how IUI,
> > >
> > > what does IUI mean? It doesn't look like any of these acronyms
> > > apply
> >
> > I Understand It.
> >
> > > https://www.acronymfinder.com/IUI.html
> > >
> > > > and no one accessing my web page (its on this  machine)
> > > >has jumped the sandbox fence in around 15 years now.
> > >
> > > That you are aware of :)
> >
> > That may be. Right now I see something from the php cleanup spamming
> > my logs.  Is anyone else see it, something cron is running several
> > times a day, but which can't be found by htop. So apparently it goes
> > away when its done.  And AFAIK, nothings running thats php5 related.
> >
> > Looking around, it appears the /var/log/httpd directory is missing
> > so that log is being redirected to the syslog. A logrotate missfire?
>
> And I find an apache2 related script missing in /etc/logrotate.d
> called httpd-prerotate, but its not there.  $me goes wandering off in
> search of some caffeine.

And after another hours poking around I found apache2 was running, error 
in line 233 of the conf script.

Looking that up, it seems apache2 has got to have access to pnopaste now, 
but its never been installed till now.

WTH  changed that?, and what does it do?  Still scratching head as 
pnopaste is a pastebin clone from the description I've read so far.

Can someone educate me?



-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#201877

Hi Gene,

Am 30.10.18 um 14:24 schrieb Gene Heskett:
> On Tuesday 30 October 2018 06:15:28 Jonathan Dowland wrote:
> 
>> On Sun, Oct 28, 2018 at 07:57:08PM -0400, Gene Heskett wrote:
>>> Thats how IUI,
>>
>> what does IUI mean? It doesn't look like any of these acronyms apply
>>
> I Understand It.
> 
>> https://www.acronymfinder.com/IUI.html
>>
>>> and no one accessing my web page (its on this  machine)
>>> has jumped the sandbox fence in around 15 years now.
>>
>> That you are aware of :)
> 
> That may be. Right now I see something from the php cleanup spamming my 
> logs.  Is anyone else see it, something cron is running several times a 
> day, but which can't be found by htop. So apparently it goes away when 
> its done.  And AFAIK, nothings running thats php5 related.
> 
> Looking around, it appears the /var/log/httpd directory is missing so 
> that log is being redirected to the syslog. A logrotate missfire?

it's /var/log/apache2/ in Debian.
I prefer rotatelogs(8) over logrotate. You don't have to mess with file handles on rotation.

[toc] | [prev] | [next] | [standalone]

#201961

On Tue, Oct 30, 2018 at 09:24:25AM -0400, Gene Heskett wrote:
>That may be. Right now I see something from the php cleanup spamming my
>logs.  Is anyone else see it, something cron is running several times a
>day, but which can't be found by htop. So apparently it goes away when
>its done.  And AFAIK, nothings running thats php5 related.

Note that PHP5 is not available in the current Debian stable release.
Are you (knowingly) running oldstable (which does still have support
thanks to the LTS effort/Freexian)? If not, you may be vulnerable to
PHP5 security problems. It would be worth seeing if your scripts can
work in PHP7 instead.

I actually was caught by surprise by this myself, as I have PHP on my
web server but I don't make active use of it myself (it's installed
for stuff my colleagues use)

-- 

⢀⣴⠾⠻⢶⣦⠀
⣾⠁⢠⠒⠀⣿⡁ Jonathan Dowland
⢿⡄⠘⠷⠚⠋⠀ https://jmtd.net
⠈⠳⣄⠀⠀⠀⠀ Please do not CC me, I am subscribed to the list.

[toc] | [prev] | [next] | [standalone]

#201968

On Thursday 01 November 2018 07:50:11 Jonathan Dowland wrote:

> On Tue, Oct 30, 2018 at 09:24:25AM -0400, Gene Heskett wrote:
> >That may be. Right now I see something from the php cleanup spamming
> > my logs.  Is anyone else see it, something cron is running several
> > times a day, but which can't be found by htop. So apparently it goes
> > away when its done.  And AFAIK, nothings running thats php5 related.
>
> Note that PHP5 is not available in the current Debian stable release.

> Are you (knowingly) running oldstable?

No, wheezy because LCNC still runs on it. I understand a stretch release, 
probably with an old 3.something rt kernel for a kernel is being worked 
on. There are hideous problems with irq latency in later 64 bit kernels 
so they are not able to do the stuff LCNC needs to do in anything 
resembling realtime.

> (which does still have support 
> thanks to the LTS effort/Freexian)? If not, you may be vulnerable to
> PHP5 security problems. It would be worth seeing if your scripts can
> work in PHP7 instead.

Frankly, I'd just as soon rip it out.  I'm not knowingly using it and 
neither is LCNC and its turned into a huge security liability I sure 
don't need to have to worry about. 

> I actually was caught by surprise by this myself, as I have PHP on my
> web server but I don't make active use of it myself (it's installed
> for stuff my colleagues use)

Thanks all.

-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [next] | [standalone]

#201951

On 2018-10-28 23:57, Gene Heskett wrote:

> I don't think thats how it works. UID/GID as www-data is just part of 
> the
> sandbox apache2 and its ilk play in. In fact after I've equipt apach2
> with some new toy, the last thing I do as root is a chown -R
> www-data:www-data any directory apache2 can access in going about its
> normal business.

That's what I've always done but the perceived wisdom is
directories 750
files 640
owned root
group www-data

with the odd exception.

mick

-- 
Key ID    4BFEBB31

[toc] | [prev] | [next] | [standalone]

#201822

On 29/10/2018 10:26, Carl Fink wrote:
> On 10/28/2018 05:16 PM, mick crane wrote:
>> what's the deal with www-data ?
>> I never made that user
>> I dunno if it has a password or what ?
>> these are things that some setup / install makes ?
> It's created by the Apache installer. Check the Apache docs.

And I should mention that the www-data user can also be used by other 
web servers such as nginx, although apache is the usual suspect. The 
idea of having a common user for all web servers is to allow switching 
between server implementations without having to chown all your static 
content.

Kind regards,

-- 
Ben Caradoc-Davies <ben@transient.nz>
Director
Transient Software Limited <https://transient.nz/>
New Zealand

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web