From c4e721bfaeb192c70cc92efc422bcc0f8f9df389 Mon Sep 17 00:00:00 2001 From: Nick Kew Date: Wed, 12 Nov 2008 01:31:39 +0000 Subject: [PATCH] Introduce mod_unixd into the documentation git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@713242 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/mod/mod_cgi.xml | 2 +- docs/manual/mod/mod_dav.xml | 12 +-- docs/manual/mod/mod_dav_fs.xml | 4 +- docs/manual/mod/mod_dav_lock.xml | 4 +- docs/manual/mod/mod_suexec.xml | 2 +- docs/manual/mod/mod_unixd.xml | 143 ++++++++++++++++++++++++++++ docs/manual/mod/mod_unixd.xml.meta | 12 +++ docs/manual/mod/mpm_common.xml | 145 ----------------------------- docs/manual/mod/prefork.xml | 8 +- docs/manual/mod/worker.xml | 8 +- 10 files changed, 175 insertions(+), 165 deletions(-) create mode 100644 docs/manual/mod/mod_unixd.xml create mode 100644 docs/manual/mod/mod_unixd.xml.meta diff --git a/docs/manual/mod/mod_cgi.xml b/docs/manual/mod/mod_cgi.xml index 029d1c0484..202426243e 100644 --- a/docs/manual/mod/mod_cgi.xml +++ b/docs/manual/mod/mod_cgi.xml @@ -177,7 +177,7 @@

This log will be opened as the user the child processes run as, i.e. the user specified in the main User directive. This means that + module="mod_unixd">User directive. This means that either the directory the script log is in needs to be writable by that user or the file needs to be manually created and set to be writable by that user. If you place the script log in diff --git a/docs/manual/mod/mod_dav.xml b/docs/manual/mod/mod_dav.xml index 9894f4e0c3..06bd77eb28 100644 --- a/docs/manual/mod/mod_dav.xml +++ b/docs/manual/mod/mod_dav.xml @@ -62,8 +62,8 @@

The directory containing the lock database file must be - writable by the User - and Group under which + writable by the User + and Group under which Apache is running.

You may wish to add a In order for mod_dav to manage files, it must be able to write to the directories and files under its control - using the User and - Group under which + using the User and + Group under which Apache is running. New files created will also be owned by this - User and Group. For this reason, it is + User and Group. For this reason, it is important to control access to this account. The DAV repository is considered private to Apache; modifying files outside of Apache (for example using FTP or filesystem-level tools) should not be diff --git a/docs/manual/mod/mod_dav_fs.xml b/docs/manual/mod/mod_dav_fs.xml index ecb709aafd..6fdfe1be39 100644 --- a/docs/manual/mod/mod_dav_fs.xml +++ b/docs/manual/mod/mod_dav_fs.xml @@ -71,8 +71,8 @@

The directory containing the lock database file must be - writable by the User - and Group under which + writable by the User + and Group under which Apache is running. For security reasons, you should create a directory for this purpose rather than changing the permissions on an existing directory. In the above example, Apache will create diff --git a/docs/manual/mod/mod_dav_lock.xml b/docs/manual/mod/mod_dav_lock.xml index 60dfa111f7..d1f0a9e86e 100644 --- a/docs/manual/mod/mod_dav_lock.xml +++ b/docs/manual/mod/mod_dav_lock.xml @@ -76,8 +76,8 @@

The directory containing the lock database file must be - writable by the User - and Group under which + writable by the User + and Group under which Apache is running. For security reasons, you should create a directory for this purpose rather than changing the permissions on an existing directory. In the above example, Apache will create diff --git a/docs/manual/mod/mod_suexec.xml b/docs/manual/mod/mod_suexec.xml index 75e9d07c54..61f13e2115 100644 --- a/docs/manual/mod/mod_suexec.xml +++ b/docs/manual/mod/mod_suexec.xml @@ -53,7 +53,7 @@ later.

The SuexecUserGroup directive allows you to specify a user and group for CGI programs to run as. Non-CGI requests are still processes with the user specified in the User directive. This directive replaces + module="mod_unixd">User directive. This directive replaces the Apache 1.3 configuration of using the User and Group directives inside of VirtualHosts.

diff --git a/docs/manual/mod/mod_unixd.xml b/docs/manual/mod/mod_unixd.xml new file mode 100644 index 0000000000..5ae2032b9e --- /dev/null +++ b/docs/manual/mod/mod_unixd.xml @@ -0,0 +1,143 @@ + + + + + + + + + +mod_unixd +Basic (required) security for Unix-family platforms. +Core + + +Group +Group under which the server will answer +requests +Group unix-group +Group #-1 +server config +Only valid in global server config since Apache +2.0 + + +

The Group directive sets the group under + which the server will answer requests. In order to use this + directive, the server must be run initially as root. If + you start the server as a non-root user, it will fail to change to the + specified group, and will instead continue to run as the group of the + original user. Unix-group is one of:

+ +
+
A group name
+
Refers to the given group by name.
+ +
# followed by a group number.
+
Refers to a group by its number.
+
+ + Example + Group www-group + + +

It is recommended that you set up a new group specifically for + running the server. Some admins use user nobody, + but this is not always possible or desirable.

+ + Security +

Don't set Group (or User) to root unless + you know exactly what you are doing, and what the dangers are.

+ + + +VHostGroup +SuexecUserGroup + + + +User +The userid under which the server will answer +requests +User unix-userid +User #-1 +server config +Only valid in global server config since Apache +2.0 + + +

The User directive sets the user ID as + which the server will answer requests. In order to use this + directive, the server must be run initially as root. + If you start the server as a non-root user, it will fail to change + to the lesser privileged user, and will instead continue to run as + that original user. If you do start the server as root, + then it is normal for the parent process to remain running as root. + Unix-userid is one of:

+ +
+
A username
+
Refers to the given user by name.
+ +
# followed by a user number.
+
Refers to a user by its number.
+
+ +

The user should have no privileges that result in it being + able to access files that are not intended to be visible to the + outside world, and similarly, the user should not be able to + execute code that is not meant for HTTP requests. It is + recommended that you set up a new user and group specifically for + running the server. Some admins use user nobody, but + this is not always desirable, since the nobody user + can have other uses on the system.

+ + Security +

Don't set User (or Group) to root unless + you know exactly what you are doing, and what the dangers are.

+ + + +VHostUser +SuexecUserGroup + + + +ChrootDir +Directory for apache to run chroot(8) after startup. +ChrootDir /path/to/directory +none +server config +event +preforkworker + + +

This directive, available in httpd 2.2.9(?) and later, tells the + server to chroot(8) to the specified directory after + startup, but before accepting requests over the 'net.

+

Note that running the server under chroot is not simple, + and requires additional setup, particularly if you are running + scripts such as CGI or PHP. Please make sure you are properly + familiar with the operation of chroot before attempting to use + this feature.

+ + + + diff --git a/docs/manual/mod/mod_unixd.xml.meta b/docs/manual/mod/mod_unixd.xml.meta new file mode 100644 index 0000000000..6e9b0ff3da --- /dev/null +++ b/docs/manual/mod/mod_unixd.xml.meta @@ -0,0 +1,12 @@ + + + + + mod_unixd + /mod/ + .. + + + en + + diff --git a/docs/manual/mod/mpm_common.xml b/docs/manual/mod/mpm_common.xml index 126b813e04..d428dd9783 100644 --- a/docs/manual/mod/mpm_common.xml +++ b/docs/manual/mod/mpm_common.xml @@ -195,63 +195,6 @@ will exit. - -Group -Group under which the server will answer -requests -Group unix-group -Group #-1 -server config -beosleader -mpmt_os2perchildprefork -threadpoolworker -Only valid in global server config since Apache -2.0 - - -

The Group directive sets the group under - which the server will answer requests. In order to use this - directive, the server must be run initially as root. If - you start the server as a non-root user, it will fail to change to the - specified group, and will instead continue to run as the group of the - original user. Unix-group is one of:

- -
-
A group name
-
Refers to the given group by name.
- -
# followed by a group number.
-
Refers to a group by its number.
-
- - Example - Group www-group - - -

It is recommended that you set up a new group specifically for - running the server. Some admins use user nobody, - but this is not always possible or desirable.

- - Security -

Don't set Group (or User) to root unless - you know exactly what you are doing, and what the dangers are.

- - -

Special note: Use of this directive in VirtualHost is no longer supported. To - configure your server for suexec use - SuexecUserGroup.

- - Note -

Although the Group directive is present - in the beos and mpmt_os2 MPMs, - it is actually a no-op there and only exists for compatibility - reasons.

- - - - PidFile File where the server records the process ID @@ -955,92 +898,4 @@ client connections - -User -The userid under which the server will answer -requests -User unix-userid -User #-1 -server config -leaderperchild -preforkthreadpoolworker - -Only valid in global server config since Apache -2.0 - - -

The User directive sets the user ID as - which the server will answer requests. In order to use this - directive, the server must be run initially as root. - If you start the server as a non-root user, it will fail to change - to the lesser privileged user, and will instead continue to run as - that original user. If you do start the server as root, - then it is normal for the parent process to remain running as root. - Unix-userid is one of:

- -
-
A username
-
Refers to the given user by name.
- -
# followed by a user number.
-
Refers to a user by its number.
-
- -

The user should have no privileges that result in it being - able to access files that are not intended to be visible to the - outside world, and similarly, the user should not be able to - execute code that is not meant for HTTP requests. It is - recommended that you set up a new user and group specifically for - running the server. Some admins use user nobody, but - this is not always desirable, since the nobody user - can have other uses on the system.

- - Security -

Don't set User (or Group) to root unless - you know exactly what you are doing, and what the dangers are.

- - -

With the perchild MPM, which is intended to - server virtual hosts run under different user IDs, the - User directive defines the user ID for the - main server and the fallback for VirtualHost sections without an - AssignUserID directive.

- -

Special note: Use of this directive in VirtualHost is no longer supported. To - configure your server for suexec use - SuexecUserGroup.

- - Note -

Although the User directive is present - in the beos and mpmt_os2 MPMs, - it is actually a no-op there and only exists for compatibility - reasons.

- - - - - -ChrootDir -Directory for apache to run chroot(8) after startup. -ChrootDir /path/to/directory -none -server config -event -preforkworker - - -

This directive, available in httpd 2.2.9(?) and later, tells the - server to chroot(8) to the specified directory after - startup, but before accepting requests over the 'net.

-

Note that running the server under chroot is not simple, - and requires additional setup, particularly if you are running - scripts such as CGI or PHP. Please make sure you are properly - familiar with the operation of chroot before attempting to use - this feature.

- - - diff --git a/docs/manual/mod/prefork.xml b/docs/manual/mod/prefork.xml index febbf5d732..c5288611dd 100644 --- a/docs/manual/mod/prefork.xml +++ b/docs/manual/mod/prefork.xml @@ -74,8 +74,8 @@ uses

While the parent process is usually started as root under Unix in order to bind to port 80, the child processes are launched by Apache as a less-privileged user. The User and Group directives are used to set + module="mod_unixd">User and Group directives are used to set the privileges of the Apache child processes. The child processes must be able to read all the content that will be served, but should have as few privileges beyond that as possible.

@@ -113,9 +113,9 @@ uses StartServers -User +User -Group +Group AcceptMutex diff --git a/docs/manual/mod/worker.xml b/docs/manual/mod/worker.xml index 5593a5f40c..1490cb2d11 100644 --- a/docs/manual/mod/worker.xml +++ b/docs/manual/mod/worker.xml @@ -123,8 +123,8 @@ uses

While the parent process is usually started as root under Unix in order to bind to port 80, the child processes and threads are launched by Apache as a less-privileged user. The User and Group directives are used to set + module="mod_unixd">User and Group directives are used to set the privileges of the Apache child processes. The child processes must be able to read all the content that will be served, but should have as few privileges beyond that as possible. In @@ -143,7 +143,7 @@ uses EnableExceptionHook -Group +Group PidFile @@ -179,7 +179,7 @@ uses ThreadStackSize -User +User -- 2.40.0