note 3195 deleted from install.apache by imajes
| From: | imajes@php.net | Date: | Sun, 07 Apr 2002 11:38:31 +0000 |
| Subject: | note 3195 deleted from install.apache by imajes | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-28856@lists.php.net to get a copy of this message | ||
Running apache chroot's as root is an okay idea (provided user files are below the chroot).
but running it as root is STILL a bad idea. it's possible to break out of a chroot jail if you
manage to get root....it's pretty easy infact....
NEVER EVER EVER run ANYTHING as root that doesn't need it. go read a security HOWTO :)
I suggest adding a 'webserver' group (or just chgrp user dirs to 'webserver'
instead of whatever group they are in) and letting apache run as that.