I would like to run apache as the user "ubuntu" so that we don't have issues with file permissions. We deploy files using "ubuntu", but if the web server creates or updates files, the user is changed to "www-data" and it's a pain to fix permission issues all the time. I know that SUExec does something like this by running apache as the owner of the root web folder. Are there any security concerns running apache as the user "ubuntu"?

  • You do understand what a group does? ;-) www-data and ubuntu in the same group would do the same as you want but does not change the defaults apache comes with. Easier and less hassle I'd say ;) – Rinzwind Aug 10 '16 at 22:20
  • "security" is not an issue when using another user name for apache. The name is trivial. It is the permissions you need to set correctly. – Rinzwind Aug 10 '16 at 22:21
  • @Rinzwind - Yes I understand groups. That doesn't really help because then all permissions have to be setup at the group. For example, if I want write permissions I would have to do something like 775. I would much rather have it be 755, which is standard and only the owner has write permissions. It's very easy to run Apache as another user and way less hassle. SUExec already does this and many sites run this way for this exact reason. My question was regarding security. Is it OK to run apache as the user "ubuntu". – Sean Aug 11 '16 at 21:15

I think I may have found the answer to my question. Since the user "ubuntu" is part of the sudoers file and it has the ability to act as root, badly coded sites could be especially vulnerable if user-entered parameters are not properly escaped or sanitized. This could be a problem with PHP's exec() function, for example. I think I will setup a new user and run Apache as that user, change the owner of the web folder and it's contents, and setup our deployment service to login with that user. Should be safer this way.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.