Re: Solaris 10 necessary file question
Glenn Brunette <[email protected]> Mon, 06 Nov 2006 12:22:46 -0500
| Newsgroups | gmane.comp.security.sun |
|---|---|
| Message-ID | <[email protected]> |
Rogier Mulhuijzen wrote: > mail and local (to local) mail. I'm not sure the www account owns any > files on a default install, but if it does, I expect them to be part of > a web administration thingy. If you install or need Apache at any point, Solaris does not have a "www" account although it does have a "webservd" which does appear to own a file things: blackhole$ grep webservd /var/sadm/install/contents /var/apache2/logs d none 0755 webservd webservd SUNWapch2r /var/apache2/proxy d none 0755 webservd webservd SUNWapch2r It was created for use by the Apache 2.0 service. > make sure it is configured to run using the nobody user, or keep the www > user. No! No one should be using the "nobody" account unless it is to support NFS services: blackhole$ grep nobody /etc/passwd nobody:x:60001:60001:NFS Anonymous Access User:/: nobody4:x:65534:65534:SunOS 4.x NFS Anonymous Access User:/: The web server should use webservd (which it does by default with the Apache 2.0 in Solaris 10). For Apache 1.0, there is a bug filed already: 4806419 If you need an account for your web server, use webservd or create a new one for it. That way, access to that service, its processes, its configs and its data can be more easily controlled. g