Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #201846

Re: www-data

Show all headers | View raw

On Sun 28 Oct 2018 at 19:57:08 (-0400), Gene Heskett wrote:
> On Sunday 28 October 2018 18:42:41 mick crane wrote:
> > On 2018-10-28 21:38, Ben Caradoc-Davies wrote:
> > > On 29/10/2018 10:26, Carl Fink wrote:
> > >> On 10/28/2018 05:16 PM, mick crane wrote:
> > >>> what's the deal with www-data ?
> > >>> I never made that user
> > >>> I dunno if it has a password or what ?
> > >>> these are things that some setup / install makes ?

If you are merely alarmed, perhaps read
/usr/share/doc/base-passwd/users-and-groups.txt.gz
where you'll see that user/group 33 is reserved for this user.

> > >> It's created by the Apache installer. Check the Apache docs.

… but bear in mind that you don't have to install apache for
that user/group to be created on your system.

> > > And it should have no password. This user is accessed by switching
> > > to it from root. As a security measure, after binding to privileged
> > > network ports as root, apache switches to user www-data so that, if
> > > it is compromised, the damage is limited. Processes that have
> > > dropped root privileges cannot automatically regain them. Postgres
> > > and Tomcat do the same thing with their own dedicated users.
> >
> > I'm asking because somebody is saying that webmail server files should
> > be owned by root but I don't know about that, if somebody as got so
> > far to be www-data they might as well be root ?

Then you probably need to read the docs carefully, rather than taking
any notice of what's written below, which contradicts anything I've
read on this subject.

> I don't think thats how it works. UID/GID as www-data is just part of the 
> sandbox apache2 and its ilk play in. In fact after I've equipt apach2 
> with some new toy, the last thing I do as root is a chown -R 
> www-data:www-data any directory apache2 can access in going about its 
> normal business.
> 
> Thats how IUI, and no one accessing my web page (its on this  machine) 
> has jumped the sandbox fence in around 15 years now.

Why would they bother.

Cheers,
David.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

www-data mick crane <mick.crane@gmail.com> - 2018-10-28 22:20 +0100
  Re: www-data Carl Fink <carlf@panix.com> - 2018-10-28 22:30 +0100
    Re: www-data Ben Caradoc-Davies <ben@transient.nz> - 2018-10-28 22:50 +0100
      Re: www-data mick crane <mick.crane@gmail.com> - 2018-10-28 23:50 +0100
        Re: www-data Ben Caradoc-Davies <ben@transient.nz> - 2018-10-29 00:10 +0100
        Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-29 01:00 +0100
          Re: www-data David Wright <deblis@lionunicorn.co.uk> - 2018-10-29 18:30 +0100
            Re: www-data Michael Stone <mstone@debian.org> - 2018-10-29 20:30 +0100
          Re: www-data Jonathan Dowland <jmtd@debian.org> - 2018-10-30 11:20 +0100
            Re: www-data Curt <curty@free.fr> - 2018-10-30 11:50 +0100
            Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-30 14:30 +0100
              Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-30 14:40 +0100
                Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-10-30 15:30 +0100
              Re: www-data Martin <keine-eile@online.de> - 2018-10-30 15:10 +0100
              Re: www-data Jonathan Dowland <jmtd@debian.org> - 2018-11-01 13:00 +0100
                Re: www-data Gene Heskett <gheskett@shentel.net> - 2018-11-01 16:40 +0100
          Re: www-data mick crane <mick.crane@gmail.com> - 2018-10-31 21:00 +0100
    Re: www-data Ben Caradoc-Davies <ben@transient.nz> - 2018-10-28 23:00 +0100

csiph-web