Re: Solaris 10 necessary file question

Glenn Brunette <[email protected]> Mon, 06 Nov 2006 12:22:46 -0500
Newsgroups gmane.comp.security.sun
Message-ID <[email protected]>

Rogier Mulhuijzen wrote:

> mail and local (to local) mail. I'm not sure the www account owns any
> files on a default install, but if it does, I expect them to be part of
> a web administration thingy. If you install or need Apache at any point,

Solaris does not have a "www" account although it does have a
"webservd" which does appear to own a file things:

blackhole$ grep webservd /var/sadm/install/contents
/var/apache2/logs d none 0755 webservd webservd SUNWapch2r
/var/apache2/proxy d none 0755 webservd webservd SUNWapch2r

It was created for use by the Apache 2.0 service.

> make sure it is configured to run using the nobody user, or keep the www
> user.

No!  No one should be using the "nobody" account unless it is
to support NFS services:

blackhole$ grep nobody /etc/passwd
nobody:x:60001:60001:NFS Anonymous Access User:/:
nobody4:x:65534:65534:SunOS 4.x NFS Anonymous Access User:/:

The web server should use webservd (which it does by default with the
Apache 2.0 in Solaris 10).  For Apache 1.0, there is a bug filed
already: 4806419

If you need an account for your web server, use webservd or create
a new one for it.  That way, access to that service, its processes,
its configs and its data can be more easily controlled.

g