Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #201826

Re: www-data

Show all headers | View raw

On Sunday 28 October 2018 18:42:41 mick crane wrote:

> On 2018-10-28 21:38, Ben Caradoc-Davies wrote:
> > On 29/10/2018 10:26, Carl Fink wrote:
> >> On 10/28/2018 05:16 PM, mick crane wrote:
> >>> what's the deal with www-data ?
> >>> I never made that user
> >>> I dunno if it has a password or what ?
> >>> these are things that some setup / install makes ?
> >>
> >> It's created by the Apache installer. Check the Apache docs.
> >
> > And it should have no password. This user is accessed by switching
> > to it from root. As a security measure, after binding to privileged
> > network ports as root, apache switches to user www-data so that, if
> > it is compromised, the damage is limited. Processes that have
> > dropped root privileges cannot automatically regain them. Postgres
> > and Tomcat do the same thing with their own dedicated users.
>
> I'm asking because somebody is saying that webmail server files should
> be owned by root but I don't know about that, if somebody as got so
> far to be www-data they might as well be root ?
>
> mick

I don't think thats how it works. UID/GID as www-data is just part of the 
sandbox apache2 and its ilk play in. In fact after I've equipt apach2 
with some new toy, the last thing I do as root is a chown -R 
www-data:www-data any directory apache2 can access in going about its 
normal business.

Thats how IUI, and no one accessing my web page (its on this  machine) 
has jumped the sandbox fence in around 15 years now.

-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page <http://geneslinuxbox.net:6309/gene>

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

www-data mick crane <mick.crane@gmail.com> - 2018-10-28 22:20 +0100
  Re: www-data Carl Fink <carlf@panix.com> - 2018-10-28 22:30 +0100
    Re: www-data Ben Caradoc-Davies <ben@transient.nz> - 2018-10-28 22:50 +0100
      Re: www-data mick crane <mick.crane@gmail.com> - 2018-10-28 23:50 +0100
        Re: www-data Ben Caradoc-Davies <ben@transient.nz> - 2018-10-29 00:10 +0100
        Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-29 01:00 +0100
          Re: www-data David Wright <deblis@lionunicorn.co.uk> - 2018-10-29 18:30 +0100
            Re: www-data Michael Stone <mstone@debian.org> - 2018-10-29 20:30 +0100
          Re: www-data Jonathan Dowland <jmtd@debian.org> - 2018-10-30 11:20 +0100
            Re: www-data Curt <curty@free.fr> - 2018-10-30 11:50 +0100
            Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-30 14:30 +0100
              Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-30 14:40 +0100
                Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-30 15:30 +0100
              Re: www-data Martin <keine-eile@online.de> - 2018-10-30 15:10 +0100
              Re: www-data Jonathan Dowland <jmtd@debian.org> - 2018-11-01 13:00 +0100
                Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-11-01 16:40 +0100
          Re: www-data mick crane <mick.crane@gmail.com> - 2018-10-31 21:00 +0100
    Re: www-data Ben Caradoc-Davies <ben@transient.nz> - 2018-10-28 23:00 +0100

csiph-web