Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top
root@ip-172-31-38-0:/var/www# ps aux | egrep '(apache|httpd)'
root      1086  0.0  0.3  88480  3160 ?        Ss   Mar08   0:09 /usr/sbin/apache2 -k start
www-data  1089  0.0  0.8 445500  8840 ?        Sl   Mar08   0:56 /usr/sbin/apache2 -k start
www-data  1090  0.0  0.8 445564  8832 ?        Sl   Mar08   0:56 /usr/sbin/apache2 -k start
root     12072  0.0  0.0   8160   932 pts/0    S+   19:20   0:00 egrep --color=auto (apache|httpd)

can sum1 please inform about the 1086 apache process run by the root. Is this a security issue?

share|improve this question
up vote 2 down vote accepted

No, this is normal. On Debian-based systems, apache2 is started as root. It then forks off and runs under an unprivileged user (typically www-data). The actual work is done by these processes.

Only a privileged process can bind to ports below 1024. So, at least for binding to the default 80 and 443 ports, it will have to run as root.

And, among other things, the original process reads SSL certificate private keys, which are typically only read by root. From /usr/share/doc/apache2/README.Debian.gz:

The SSL key file should only be readable by root; the certificate file may be
globally readable. These files are read by the Apache parent process which runs
as root, and it is therefore not necessary to make the files readable by the
www-data user.

So, this is documented behaviour.

share|improve this answer
    
14 seconds :P sigh – Rinzwind Mar 12 at 22:48
    
@Rinzwind >:D And I'm over my limit for today too. :P – muru Mar 12 at 22:49
    
nice. thought it was a slow day and you managed it pretty well :) 55 to go for me :P – Rinzwind Mar 12 at 22:50

No. Apache is always started as "root" and it then uses "setuid" to spawn children that do the actually processing of requests for the apache user.

If you want to create a listening socket on a privileged port (so one below port 1024) you must do that as root (or to be more precise: with user ID 0). Port 80 and 443 for SSL.

So ... if you do no trust Apache to bind to a socket you should not run a webserver on your server.

See for instance http://www.thegeekstuff.com/2011/03/apache-hardening/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.