Apache user and disabling shell

dai · 06-30-2003, 08:42 AM

Okay just wondering if the user you specify to run Apache as doesent have /bin/bash but instead /bin/false as its shell would this stop a system command sent in in the url of the browser being run on the server.

I am assuming that the annonymous user is logged in locally as the 'nobody' or 'webuser' account (limited access) that Apache runs as and thus has no access to the shell as its set to /bin/false in /etc/passwrd thus cant run a system command.

or am i completely wrong???

unSpawn · 07-02-2003, 06:28 AM

You need an intermediary application to interprete the URI and execute the commands, Apache itself can't do that. The interpreting application (like Perl) will be run from one of the httpd child processes, running with the privileges for the Apache UID.
The /bin/false shell means it is a system account you can't login to but that does not prohibit http(s)d's child processes to run system commands.

If you want a quick checkup on the environment variables, limits etc, Google around for env_audit.

dai · 07-02-2003, 03:36 PM

Cheers UnSpawn.

Im going to Use PHP so I'll probably turn on safe mode and global vars off. I assume this is the most secure setup for it.

Ive disabled CGI during ./configure and didnt compile Perl Support so hopefully this means that the server is relatively secure at the application level.