topic Re: Apache User Check in Operating System - Linux

Apache User Check

girishb — Mon, 11 Sep 2006 16:28:44 GMT

Hi,

We have Apache Web Server installed on Redhat Enterprise Linux, the web server is hosting our company website.

I'm new to web server services. I would like to know, how do we check on what user the web server is running.

Also how do I make it secure.

Thanks in advance for the responses.

Regards
Girish

Re: Apache User Check

Ivan Ferreira — Mon, 11 Sep 2006 17:07:19 GMT

You can use:

ps auxw |grep httpd

To identify the user that runs tha httpd process.

You can also check the httpd.conf for the options:

User
Group

Normally will be set to Apache.

There are a lot of books about how to secure apache. If you have lucky enough, you can find some ebooks for free.

Re: Apache User Check

Steven E. Protter — Mon, 11 Sep 2006 20:17:49 GMT

Shalom Girish,

As noted apache is usually the owner of the httpd processes.

If you are thinking of changing it, note that the user id of the web server is defined in the /etc/httpd/conf/httpd.conf file.

SEP

Re: Apache User Check

Vitaly Karasik_1 — Tue, 12 Sep 2006 02:29:58 GMT

And as for Apache hardening - it's not so trivial, if you take into account dynamic sites with PHP/DB and so on.
But for start:
RHEL manual http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/security-guide/

and
http://xianshield.org/guides/apache2.0guide.html

Re: Apache User Check

girishb — Tue, 12 Sep 2006 07:20:43 GMT

Thanks folks for the response.

I found the webserver is being run by user "nobody" . I hope it to be safe.

Re: Apache User Check

Matti_Kurkela — Tue, 12 Sep 2006 08:10:00 GMT

Some basic points to making Apache secure:

* Most of Apache's functionality is split into different modules. Usually the default configuration includes modules you don't need in your specific situation. Disable the modules you don't need: it makes your configuration simpler to handle, and reducing the amount of running code will also reduce the possibility of security holes.

* Know where Apache (and the scripts and/or CGI programs) needs to be able to write. Then keep the file permissions strict, so that Apache can write to only those files and directories it is required to write, and nowhere else.

* If you create scripts to process input from users, *always* assume the user's input is designed with a hostile intent to cause malfunctions in your script until you have checked it for correctness.

Re: Apache User Check

George Liu_4 — Wed, 13 Sep 2006 13:28:07 GMT

n typical operation, Apache is started by the root user, and it switches to the user defined by the User directive to serve hits.

Re: Apache User Check

girishb — Wed, 13 Sep 2006 17:10:59 GMT

Thanks all for the reply.

Re: Apache User Check

girishb — Thu, 14 Sep 2006 15:13:37 GMT

Thanks folks.