non-root user wants to run apache and use port 80

[Bill Costigan]

Is there some permission that can be applied to a user to allow apache to run as that user and still bind to port 80?

Thanks

[Torsten.]

Hi Bill,

the apache httpd will run as user configured in the httpd.conf file.

T.

[Bill Costigan]

The issue is allowing apache to use port 80. Only root and system processes can open ports less than 1024 (or is it 1023.)

What I don't know is what the system looks at to determine if the user is root. Is it a UID of zero or something else.

Can I make the system allow another user to open port 80.

[A. Clay Stephenson · Accepted solution]

Httpd must be started with an effective uid of 0 in order to use a port <= 1023. This can be done via sudo by a regular user. After the daemon starts and opens the port, it can do a setuid/setgid to change to a non-root user if the User and Group entries in httpd.conf are defined.

[Bill Costigan]

Thanks.

I don't think I could get apache to issue the suid back after it opens the port. So I'd have to leave it running as 0.

[Torsten.]

taken from the apache FAQ:

"...the typical Apache setup has the server started as root to bind to port 80, after which it changes UIDs to a non-privileged user to serve requests."

In fact, the non privileged user is that one defined in httpd.conf.

[Bill Costigan]

Torsten,

Thanks, That was the piece I was missing. I assumed that it would try to open the port as the user in the hpptd.conf file.

I'll have them try that

[Steven E. Protter]

It is possible to configure apache to run in a chroot mode, which lessons the security hazards of running the product.

All and all lots and lots of folks use apache, grant it permission to run on port 80.

When you install the apache server as part of the HP-UX web suite, the user is added and configured correctly.

SEP