0

I believe that it's not secure to install an application whilst logged in as "root". The hosting image I used doesn't create a non-root sudo user by default, when the server boots you log in as root@servername not as a sudo user created during boot up that would happen if I installed from ISO.

If I install an application whilst logged on as root, can the process owner be changed without reinstalling the application or is it more about who "starts" the application?

  • 1
    Possible duplicate of Checking the user executing the apache server – muru Aug 19 '18 at 7:21
  • Installing what as root? – Zanna Aug 19 '18 at 13:51
  • 2
    Welcome to AskUbuntu! I'm sorry but I for one am having a hard time parsing "but the VPS I tried does doesn't create a non-root user by default." specifically the does doesn't part. Please edit your post to provide clarity. Thank you for helping us help you! – Elder Geek Aug 19 '18 at 18:03
  • @webby are you sure it is ubuntu and not debian. Google cloud instances create a sudo admin account but you can sudo -i to root without the need for a password. Debian on GCI is root enabled though. Amazon does the same. – Rinzwind Aug 21 '18 at 9:46
  • Yes, sure it's root, DigitalOcean Droplet, you can even have it resend you a new root password if you can't get into console – Webby Aug 23 '18 at 14:07
5

OK, so I know you shouldn't install as root

Ubuntu is installed by default with a sudo administration. That does not mean it can not be used as a root based system. It is just considered a bit more secure: 1. nobody knows you use an admin named root so they need to find out what your admin account is. 2. Logging information with sudo is done with the user that is doing it; on a root based system it will be logged as root. And then there is the obvious one: root makes it possible to wreck your system easier than a sudo based system lets you. Those are the main reason for using a sudo based system. The other thing: everything you find on the web will be sudo based instructions.

is there a way to change the user it runs as

Yes. Even with a sudo based system it is advisable to change the user apache uses. apache or www-data is probably the user apache is installed with.

See

/etc/apache2/envvars

and

export APACHE_RUN_USER=www-data
export APACHE_RUN_GROUP=www-data

Make sure to chown your website root directory and files in it to that user and group. You could also make a different group than user so you can add users to that group not part of the website but able to write to it (from scripts running on the machine for instance).

If you log in with a different user, does it still run under root because root installed it?

Depends on how you set up the user. sudo still works on an Ubuntu based system with root enable so you can still create admin accounts (basically to kill sudo you could delete the sudo group).

Basically sudo is used as a security feature. Ubuntu used to be seen as a starter Linux and this was a good way to introduce Windows users to a rock solid security based multi user system. Running root is not a problem if you know what you are doing. I hope I do not offend anybody if I say that in my opinion the average Ubuntu user is just a desktop user and has below average knowledge of the command line to be trusted to run a root based system.

Debian for instance asks at the installation if you want to use root; if not sudo based system is installed.

1 important thing: make sure you use a strong password when using root and don't give it out to others.

Who is this running as, root or www-data?

  • the original service is run as root
  • apache then spawns childs processes that are run as the apache user (in this case www-data)

Has NOTHING to do with your system running as root. This is always the case: the main apache thread is protected from getting killed by anyone but root. You can kill the childs with the user www-data but those can and will be respawend by the main thread. In theory this should keep the website alive.

  • Thanks for the great answer. Normally when I set up Ubuntu, it is as you say but the VPS providers image goes straight in at the user "root". I'm relatively new to Linux as you will know so I'm still learning the ropes. I'm not using a password for root, I'm using a priv/pub key pair only. Is there a way to know which user the application is "running as"? For example, if the instructions say "don't install as root", and you do, how do you check for sure what user it is running as since it might create it's own user? – Webby Aug 19 '18 at 7:00
  • @Webby you can use ps -aux or top combined with grep <package_name> to see which user have laucnh the process (root, www-data, ...); so the command would be ps -aux | grep <package_name> or top | grep <package_name> – damadam Aug 21 '18 at 9:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.