[SOLVED] Running Apache under user NOBODY, security risk or not?

Basher52 · 11-01-2012, 04:37 PM

I've seen "lots" of stuff saying that httpd should not be running under the user nobody since that is a
security risk. I know the implication of such but is it really that bad?

This question popped up in my head when I saw the thing about 'ZB Block'(http://www.spambotsecurity.com/zbblock.php) where they think it's a bad *nix coniguration if you run httpd under the user nobody.

Quote:

*** TO INSTALL ***

IF ON A UNIX/LINUX HOST THAT HAS PHP RUNNING UNDER USER NAME "NOBODY"(bad idea):
Please generate.......

I've googled about this but didn't get a solution that I liked and since 'ZB Block' likes
to use suPHP (www.suphp.org/) that is made for just this, running Apache
under another user then nobody, I go to the place where I can find an answer

So, is this the extreme security risk that I've read about? if it is, is there anything other then suPHP
'cos that is kinda old.
Is there anything else I can think of in security of httpd/php? simple as advanced anything that I might
not have thought about.

//Yours Truly, 52

rknichols · 11-01-2012, 06:19 PM

As I understand it, it's only a risk if something else is also running as user "nobody", and really bad if that "something else" is Apache.

Basher52 · 11-01-2012, 06:48 PM

Quote:

Originally Posted by rknichols

As I understand it, it's only a risk if something else is also running as user "nobody", and really bad if that "something else" is Apache.

well that is the point, as I've heard Apache is normally running under that user, so how do I change that and still use PHP/MySQL without some 3rd party "hack" like suPHP?
I've also seen lately that a lot of daemons/services are using the user nobody as default and since I've never really got into this before, I just kept them there.

All servers that I installed are still using the user nobody for Apache, since it's the default, and no one have had any problems (knock knock)

Seems I need LOTS of help for this thing, even more then I thought

sundialsvcs · 11-01-2012, 07:00 PM

I see most Apache installs running as "nobody" and it's okay because those sites also strictly control what directories any particular site is allowed to see.

Is there a particular cause for concern that you see?

Basher52 · 11-01-2012, 07:30 PM

This is my 'ps aux' list

Code:

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0  39628  2068 ?        Ss   Nov01   0:01 /sbin/init
root         2  0.0  0.0      0     0 ?        S    Nov01   0:00 [kthreadd]
root         3  0.0  0.0      0     0 ?        S    Nov01   0:04 [ksoftirqd/0]
root         5  0.0  0.0      0     0 ?        S<   Nov01   0:00 [kworker/0:0H]
root         7  0.0  0.0      0     0 ?        S<   Nov01   0:00 [kworker/u:0H]
root         8  0.0  0.0      0     0 ?        S    Nov01   0:00 [migration/0]
root         9  0.0  0.0      0     0 ?        S    Nov01   0:00 [watchdog/0]
root        10  0.0  0.0      0     0 ?        S    Nov01   0:00 [migration/1]
root        12  0.0  0.0      0     0 ?        S<   Nov01   0:00 [kworker/1:0H]
root        13  0.0  0.0      0     0 ?        S    Nov01   0:04 [ksoftirqd/1]
root        14  0.0  0.0      0     0 ?        S    Nov01   0:00 [watchdog/1]
root        15  0.0  0.0      0     0 ?        S<   Nov01   0:00 [cpuset]
root        16  0.0  0.0      0     0 ?        S<   Nov01   0:00 [khelper]
root        17  0.0  0.0      0     0 ?        S    Nov01   0:00 [kdevtmpfs]
root        18  0.0  0.0      0     0 ?        S<   Nov01   0:00 [netns]
root        19  0.0  0.0      0     0 ?        S    Nov01   0:00 [bdi-default]
root        20  0.0  0.0      0     0 ?        S<   Nov01   0:00 [kintegrityd]
root        21  0.0  0.0      0     0 ?        S<   Nov01   0:00 [kblockd]
root        22  0.0  0.0      0     0 ?        S<   Nov01   0:00 [ata_sff]
root        23  0.0  0.0      0     0 ?        S    Nov01   0:00 [khubd]
root        24  0.0  0.0      0     0 ?        S<   Nov01   0:00 [md]
root        28  0.0  0.0      0     0 ?        S    Nov01   0:10 [kswapd0]
root        29  0.0  0.0      0     0 ?        SN   Nov01   0:00 [ksmd]
root        30  0.0  0.0      0     0 ?        SN   Nov01   0:04 [khugepaged]
root        31  0.0  0.0      0     0 ?        S    Nov01   0:00 [fsnotify_mark]
root        32  0.0  0.0      0     0 ?        S<   Nov01   0:00 [crypto]
root        38  0.0  0.0      0     0 ?        S<   Nov01   0:00 [kthrotld]
root        40  0.0  0.0      0     0 ?        S<   Nov01   0:00 [kpsmoused]
root        41  0.0  0.0      0     0 ?        S<   Nov01   0:00 [deferwq]
root       209  0.0  0.0      0     0 ?        S    Nov01   0:00 [scsi_eh_0]
root       211  0.0  0.0      0     0 ?        S    Nov01   0:00 [scsi_eh_1]
root       223  0.0  0.0      0     0 ?        S    Nov01   0:00 [scsi_eh_2]
root       224  0.0  0.0      0     0 ?        S    Nov01   0:00 [scsi_eh_3]
root       225  0.0  0.0      0     0 ?        S    Nov01   0:00 [kworker/u:4]
root       237  0.0  0.0      0     0 ?        S    Nov01   0:00 [kworker/u:5]
root       238  0.0  0.0      0     0 ?        S    Nov01   0:00 [scsi_eh_4]
root       239  0.0  0.0      0     0 ?        S    Nov01   0:00 [scsi_eh_5]
root       252  0.0  0.0      0     0 ?        S<   Nov01   0:00 [kworker/1:1H]
root       267  0.1  0.0      0     0 ?        S<   Nov01   0:44 [kworker/0:1H]
root       317  0.1  0.0      0     0 ?        D    Nov01   0:54 [jbd2/sda8-8]
root       318  0.0  0.0      0     0 ?        S<   Nov01   0:00 [ext4-dio-unwrit]
root       350  0.0  0.0      0     0 ?        S    Nov01   0:00 [kauditd]
root       358  0.0  0.0  17884   876 ?        Ss   Nov01   0:00 /sbin/udevd
root       370  0.0  0.0  23212   728 ?        Ss   Nov01   0:00 /lib/systemd/systemd-stdout-syslog-bridge
root       483  0.0  0.0      0     0 ?        S<   Nov01   0:00 [rpciod]
root       519  0.0  0.0      0     0 ?        S<   Nov01   0:00 [edac-poller]
root       568  0.0  0.0  17880   348 ?        S    Nov01   0:00 /sbin/udevd
root       569  0.0  0.0  17880   264 ?        S    Nov01   0:00 /sbin/udevd
root       598  0.0  0.0      0     0 ?        S<   Nov01   0:00 [ttm_swap]
root       794  0.0  0.0      0     0 ?        S    Nov01   0:00 [jbd2/sda9-8]
root       795  0.0  0.0      0     0 ?        S<   Nov01   0:00 [ext4-dio-unwrit]
root       799  0.0  0.0      0     0 ?        S    Nov01   0:03 [jbd2/sda6-8]
root       800  0.0  0.0      0     0 ?        S<   Nov01   0:00 [ext4-dio-unwrit]
root       811  0.0  0.0      0     0 ?        S    Nov01   0:01 [jbd2/sda5-8]
root       812  0.0  0.0      0     0 ?        S<   Nov01   0:00 [ext4-dio-unwrit]
root       815  0.0  0.0      0     0 ?        S    Nov01   0:00 [jbd2/sda7-8]
root       816  0.0  0.0      0     0 ?        S<   Nov01   0:00 [ext4-dio-unwrit]
root       823  0.0  0.0      0     0 ?        S    Nov01   0:00 [jbd2/sda4-8]
root       824  0.0  0.0      0     0 ?        S<   Nov01   0:00 [ext4-dio-unwrit]
root       831  0.0  0.0      0     0 ?        S    Nov01   0:00 [jbd2/sda2-8]
root       832  0.0  0.0      0     0 ?        S<   Nov01   0:00 [ext4-dio-unwrit]
root       849  0.0  0.0  25740   904 ?        S<sl Nov01   0:00 /sbin/auditd -n
root       875  0.0  0.0 122700   932 ?        Ss   Nov01   0:00 /usr/sbin/abrtd -d -s
root       883  0.0  0.0  18204   644 ?        Ss   Nov01   0:00 /usr/bin/abrt-dump-oops -rwxD /var/log/messages
root       885  0.0  0.0  80184   696 ?        S<sl Nov01   0:00 /sbin/audispd
root       888  0.0  0.0  21432   688 ?        S<   Nov01   0:00 /usr/sbin/sedispatch
root       891  0.0  0.0   6940   196 ?        Ss   Nov01   0:01 /usr/sbin/gpm -m /dev/input/mice -t exps2
root       908  0.0  0.1 279316  4880 ?        Ssl  Nov01   0:00 /usr/sbin/NetworkManager --no-daemon
root       909  0.0  0.0  20600   384 ?        Ss   Nov01   0:01 /usr/sbin/irqbalance
root       915  0.0  0.0  28432  1392 ?        Ss   Nov01   0:00 /lib/systemd/systemd-logind
root       921  0.0  0.0  11580   224 ?        Ss   Nov01   0:00 /usr/bin/system-setup-keyboard
avahi      922  0.0  0.0  28012  1228 ?        Ss   Nov01   0:00 avahi-daemon: running [linux.local]
root       924  0.0  0.0   6464   572 ?        Ss   Nov01   0:01 /usr/sbin/acpid
root       933  0.0  0.0   6444   664 ?        Ss   Nov01   0:00 /usr/sbin/mcelog --ignorenodev --daemon --foreground
avahi      934  0.0  0.0  27888    20 ?        S    Nov01   0:00 avahi-daemon: chroot helper
chrony     938  0.0  0.0  21628  1124 ?        S    Nov01   0:00 /usr/sbin/chronyd -u chrony
dbus       942  0.0  0.0  23156  2472 ?        Ss   Nov01   0:01 /bin/dbus-daemon --system --address=systemd: --nofork --systemd-activation
root       943  0.0  0.0 118364   900 ?        Ss   Nov01   0:00 /usr/sbin/crond -n
root       948  0.0  0.1 189360  3776 ?        Sl   Nov01   0:00 /usr/libexec/polkit-1/polkitd --no-debug
root       956  0.0  0.0 243128   884 ?        Ssl  Nov01   0:00 /sbin/rsyslogd -n -c 5
root       985  0.0  0.0  80940  2040 ?        S    Nov01   0:00 /usr/sbin/modem-manager
root       986  0.0  0.0  75460  2236 ?        Ss   Nov01   0:00 /usr/sbin/sshd -D
root       989  0.0  0.0  27752    84 ?        Ss   Nov01   0:00 /usr/sbin/rpc.idmapd
root       995  0.0  0.0  19172   608 ?        Ss   Nov01   0:00 /sbin/rpcbind -w
rpcuser   1010  0.0  0.0  27756   792 ?        Ss   Nov01   0:00 /sbin/rpc.statd
root      1017  0.0  0.0      0     0 ?        S<   Nov01   0:00 [iprt]
root      1097  0.0  0.0  21200   760 ?        Ss   Nov01   0:00 /usr/sbin/atd -f
root      1099  0.0  0.0 153952  2228 ?        Ssl  Nov01   0:00 /usr/sbin/gdm-binary -nodaemon
root      1101  0.0  0.3  93704 11216 ?        S    Nov01   0:00 /sbin/dhclient -d -4 -sf /usr/libexec/nm-dhcp-client.action -pf /var/run/dhclient-p2p1.pid -lf /var/lib/dhclient/dhclient-46e26279-f69b-daf5-1b79-d03677b7178d-p2p1.lease -cf /var/run/nm-dhclient-p2p1.conf p2p1
root      1115  0.0  0.1 182884  3552 ?        Sl   Nov01   0:00 /usr/libexec/gdm-simple-slave --display-id /org/gnome/DisplayManager/Display1
root      1118  8.5  3.0 202640 95484 tty2     Ss+  Nov01  39:45 /usr/bin/Xorg :0 -br -verbose -logverbose 7 -auth /var/run/gdm/auth-for-gdm-f6FIPs/database -nolisten tcp
root      1138  0.0  0.1 1034684 3284 ?        Ssl  Nov01   0:00 /usr/sbin/console-kit-daemon --no-daemon
root      1139  0.0  0.1 217580  3140 ?        Ssl  Nov01   0:00 /usr/libexec/accounts-daemon
root      1222  0.0  0.1 155776  3252 ?        Sl   Nov01   0:00 /usr/libexec/upowerd
rtkit     1280  0.0  0.0 164568  1156 ?        SNsl Nov01   0:00 /usr/libexec/rtkit-daemon
root      1295  0.0  0.1 210692  3300 ?        Sl   Nov01   0:00 gdm-session-worker [pam/gdm-password]
root      1338  0.0  0.0  91388  2188 ?        Ss   Nov01   0:00 sendmail: accepting connections
smmsp     1369  0.0  0.0  76448  1832 ?        Ss   Nov01   0:00 sendmail: Queue runner@01:00:00 for /var/spool/clientmqueue
root      1376  0.0  0.0      0     0 ?        S    Nov01   0:10 [flush-8:0]
sickan    1379  0.0  0.2 362312  9088 ?        Sl   Nov01   0:00 /usr/bin/gnome-keyring-daemon --daemonize --login
sickan    1386  0.0  0.3 430464  9500 ?        Ssl  Nov01   0:00 gnome-session
sickan    1397  0.0  0.0  22360   472 ?        S    Nov01   0:00 dbus-launch --sh-syntax --exit-with-session
sickan    1398  0.0  0.0  24112  2256 ?        Ss   Nov01   0:01 /bin/dbus-daemon --fork --print-pid 5 --print-address 7 --session
sickan    1459  0.0  0.1 318852  3744 ?        Sl   Nov01   0:00 /usr/libexec/imsettings-daemon
sickan    1462  0.0  0.0 158516  2196 ?        S    Nov01   0:00 /usr/libexec/gvfsd
sickan    1477  0.0  0.0 279468  2440 ?        Ssl  Nov01   0:00 /usr/libexec//gvfs-fuse-daemon /home/sickan/.gvfs
sickan    1563  0.0  0.5 948500 18236 ?        Sl   Nov01   0:10 /usr/libexec/gnome-settings-daemon
sickan    1564  1.9  1.9 539228 59512 ?        S<sl Nov01   8:58 /usr/bin/pulseaudio --start
sickan    1572  0.0  0.0 107948  2348 ?        S    Nov01   0:00 /usr/libexec/pulse/gconf-helper
sickan    1574  0.0  0.1 146916  3172 ?        S    Nov01   0:00 /usr/libexec/gconfd-2
root      1576  0.0  0.1 201752  3492 ?        Ss   Nov01   0:00 /usr/sbin/cupsd -f
sickan    1581  0.0  0.1 469388  3400 ?        Sl   Nov01   0:00 /usr/libexec/gsd-printer
sickan    1589  0.0  0.1 171788  3364 ?        S    Nov01   0:00 /usr/libexec/gvfs-gdu-volume-monitor
root      1592  0.0  0.1 129916  3476 ?        Sl   Nov01   0:01 /usr/libexec/udisks-daemon --no-debug
root      1593  0.0  0.0  47544   520 ?        S    Nov01   0:00 udisks-daemon: not polling any devices
sickan    1598  0.0  0.0 169276  2108 ?        S    Nov01   0:00 /usr/libexec/gvfs-gphoto2-volume-monitor
sickan    1601  0.0  0.0 241208  1984 ?        Sl   Nov01   0:00 /usr/libexec/gvfs-afc-volume-monitor
root      1603  0.0  0.1 315360  4324 ?        Ssl  Nov01   0:00 /usr/libexec/colord
sickan    1604  6.2  3.8 1713700 118216 ?      Rl   Nov01  28:13 /usr/bin/gnome-shell
sickan    1608  0.0  0.0 190092  2400 ?        Sl   Nov01   0:00 /usr/libexec/dconf-service
root      1609  0.0  0.1 534216  5760 ?        Ssl  Nov01   0:00 /usr/libexec/colord-sane
sickan    1620  0.0  0.1 294732  3780 ?        Sl   Nov01   0:00 /usr/libexec/deja-dup/deja-dup-monitor
sickan    1621  0.0  0.3 554172 10492 ?        Sl   Nov01   0:12 /usr/libexec/tracker-store
sickan    1623  0.0  0.3 508348 11472 ?        Sl   Nov01   0:03 gnome-screensaver
sickan    1626  0.0  0.2 341792  6240 ?        Sl   Nov01   0:00 /usr/libexec/tracker-miner-flickr
sickan    1627  0.0  0.3 617636 12044 ?        Sl   Nov01   0:00 nm-applet
sickan    1632  0.0  0.2 283308  8704 ?        S    Nov01   0:00 /usr/libexec/gdu-notification-daemon
sickan    1635  0.0  0.1 251136  5400 ?        S    Nov01   0:00 abrt-applet
sickan    1641  0.0  0.3 531320 10624 ?        SNl  Nov01   0:10 /usr/libexec/tracker-miner-fs
sickan    1697  0.0  0.3 435908 10160 ?        Sl   Nov01   0:00 /usr/libexec/evolution/3.2/evolution-alarm-notify
sickan    1703  0.0  0.1 331676  4064 ?        Sl   Nov01   0:00 /usr/libexec/gnome-shell-calendar-server
sickan    1706  0.0  0.3 754080 10360 ?        Sl   Nov01   0:00 /usr/libexec/e-calendar-factory
sickan    1710  0.0  0.1 321328  4832 ?        Sl   Nov01   0:00 /usr/libexec/mission-control-5
sickan    1715  0.0  0.2 387540  7080 ?        Sl   Nov01   0:00 /usr/libexec/goa-daemon
sickan    1735  0.0  0.3 462612  9728 ?        Sl   Nov01   0:00 /usr/libexec/e-addressbook-factory
sickan    1751  0.0  0.2 373264  8748 ?        Sl   Nov01   0:00 /usr/libexec/libsocialweb-core
sickan    1782  1.1  5.5 1089840 171684 ?      Sl   Nov01   5:09 /usr/lib64/thunderbird/thunderbird
sickan    1799  0.1  0.7 1127872 24608 ?       Sl   Nov01   0:36 nautilus
sickan    1812  0.0  0.5 593192 15992 ?        Sl   Nov01   0:14 gnome-terminal
sickan    1818  0.0  0.0 165308  2880 ?        S    Nov01   0:05 /usr/libexec/gvfsd-trash --spawner :1.4 /org/gtk/gvfs/exec_spaw/0
sickan    1824  0.0  0.1 267412  4628 ?        Sl   Nov01   0:00 /usr/libexec/at-spi-bus-launcher
sickan    1829  0.0  0.0   8424   704 ?        S    Nov01   0:00 gnome-pty-helper
sickan    1830  0.0  0.1 119456  4876 pts/0    Ss   Nov01   0:00 bash
sickan    1851  0.0  0.0 158520  2240 ?        S    Nov01   0:00 /usr/libexec/gvfsd-burn --spawner :1.4 /org/gtk/gvfs/exec_spaw/1
sickan    1944  0.0  0.0 124692   992 pts/0    S+   Nov01   0:00 screen -S sickan
sickan    1952  0.0  0.0 125276  1704 ?        Ss   Nov01   0:00 SCREEN -S sickan
sickan    1955  0.0  0.1 119452  4840 pts/1    Ss   Nov01   0:00 /bin/bash
sickan    2020  0.0  0.1 119452  4840 pts/2    Ss   Nov01   0:00 /bin/bash
root      2082  0.0  0.1 203080  4016 pts/2    S    Nov01   0:00 sudo -i
root      2085  0.0  0.1 119548  4984 pts/2    S    Nov01   0:00 -bash
sickan    3017  0.0  0.1 322908  3536 ?        Sl   Nov01   0:00 /usr/libexec/gvfsd-http --spawner :1.4 /org/gtk/gvfs/exec_spaw/2
nobody    3056  0.0  0.0 180748  1836 ?        Ss   Nov01   0:00 proftpd: (accepting connections)
sickan    3072 19.7 12.1 1336060 375780 ?      Sl   Nov01  63:25 /usr/lib64/firefox/firefox
sickan    3345  0.0  0.0 154148  2172 ?        S    Nov01   0:00 /usr/libexec/gvfsd-metadata
sickan    3483 27.6  7.1 1177920 220264 ?      Sl   Nov01  73:56 /usr/lib64/xulrunner/plugin-container /usr/lib64/flash-plugin/libflashplayer.so -greomni /usr/lib64/xulrunner/omni.ja -appomni /usr/lib64/firefox/omni.ja 3072 true plugin
root      3794  0.0  0.3 481076 10148 ?        Ss   Nov01   0:00 /usr/sbin/httpd -k start
apache    3796  0.2  0.4 485036 13468 ?        S    Nov01   0:31 /usr/sbin/httpd -k start
apache    3797  0.0  0.5 489560 17456 ?        S    Nov01   0:00 /usr/sbin/httpd -k start
apache    3798  0.1  0.5 489244 17180 ?        S    Nov01   0:20 /usr/sbin/httpd -k start
apache    3799  0.0  0.5 489316 17500 ?        S    Nov01   0:00 /usr/sbin/httpd -k start
apache    3800  0.0  0.4 486216 14468 ?        S    Nov01   0:00 /usr/sbin/httpd -k start
apache    3801  0.0  0.5 489316 17572 ?        S    Nov01   0:00 /usr/sbin/httpd -k start
apache    3802  0.0  0.5 489044 17328 ?        S    Nov01   0:04 /usr/sbin/httpd -k start
apache    3803  0.0  0.5 489324 17420 ?        S    Nov01   0:03 /usr/sbin/httpd -k start
mysql     3828  0.0  0.0 116292  1512 ?        Ss   Nov01   0:00 /bin/sh /usr/bin/mysqld_safe --basedir=/usr
mysql     3972  1.8  2.8 749212 86624 ?        Sl   Nov01   4:02 /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --plugin-dir=/usr/lib64/mysql/plugin --log-error=/var/log/mysqld.log --pid-file=/var/run/mysqld/mysqld.pid --socket=/var/lib/mysql/mysql.sock
root      4269  0.0  0.1 259708  3484 pts/2    S+   Nov01   0:00 alsamixer
root      4894  0.0  0.1 203080  4036 pts/1    S    Nov01   0:00 sudo -i
root      4897  0.0  0.1 119560  5080 pts/1    S    Nov01   0:00 -bash
root      5255  0.0  0.0      0     0 ?        S    Nov01   0:00 [kworker/1:2]
root      5273  0.0  0.0      0     0 ?        S    Nov01   0:00 [kworker/0:2]
root      5630  0.0  0.0      0     0 ?        S    00:01   0:00 [kworker/0:1]
apache    5830  0.0  0.4 487940 15384 ?        S    00:40   0:00 /usr/sbin/httpd -k start
root      5925  0.0  0.0      0     0 ?        S    00:57   0:00 [kworker/1:0]
root      5962  0.0  0.0      0     0 ?        S    01:02   0:00 [kworker/1:1]
root      6005  0.0  0.1 164212  4884 ?        Sl   01:06   0:00 /usr/libexec/packagekitd
root      6018  0.0  0.0 115704  1148 pts/1    R+   01:07   0:00 ps aux

and in this list I can't see anything other then that Apache is running under the "Apache" user,
and this is NOT my doing, it's the original installation of Fedora16_X64

oh btw, if this has anything to do with it, this is my OS:

Quote:

[root@localhost ~]# uname -a
Linux localhost.localdomain 3.6.2-1.fc16.x86_64 #1 SMP Wed Oct 17 05:30:01 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux

... with the latest updates

This is a test machine though so all users might not be as it would be on the servers.

btw, if you see anything "out of the ordinary" then please let me know

sundialsvcs · 11-02-2012, 09:15 AM

The "apache" user is probably listed in the password-file as one which can't log-in at all, but Apache can switch its identity to it, and the advantage here becomes that it's an easily recognizable "nobody-user." Files created by apache would be owned by that user, so it's quite obvious who created them. It's a "nobody-user" because it can't do anything, but it's not-equal to nobody and that's probably a desirable and useful thing.

I wouldn't change anything.

Basher52 · 11-02-2012, 02:52 PM

thx sundialsvcs, I'll do as you say and don't change anything.
"problem" solved