Re: Categories & httpd patching

[Michael Viron <mviron@wsdo.sao.uwf.edu>]

>Yes the box (soon to be two) are our own dedicated servers.  >I've never
heard of any security concern (and I'm reasonably >security aware) with the
master httpd running as root since it >does not actually serve pages.  
>Perhaps you could explain the reasoning for this?  If there is a >reason
for it and the patch is stable I'm all for it.

That is default apache behavior.  On ports less than 1023, apache must be
run as root initially (as stated in httpd.conf).  However, when someone
connects to  the http port (normally port 80), they are connecting as
nobody:nobody.  Also, provided web-viewable files are not root:root, there
should be no reason to be too concerned with the initial http process,
which according to the docs just listens to the port(s) you have configured
in httpd.conf, and spins off processes under "nobody" as needed.

Mike 
>
>--
>Aaron Turner, Core Developer       http://vodka.linuxkb.org/~aturner/
>Linux Knowledge Base Organization  http://linuxkb.org/
>Because world domination requires quality open documentation.
>