我什么时候应该使用“apache:apache”或“无人：无人”在我的网络服务器文件上？
背景：我记得在我原来的工作地点，Web 服务器管理员总是让我更改 httpd 可访问的文件上传目录，以便它们归 apache:apache 或 nobody:nobody 所有。
他说这是出于安全原因。
问题：您能告诉我这具体有哪些安全隐患吗？还有一种方法可以让 apache 以无人：无人的身份运行，并且这也有安全隐患吗？
TIA
Background: I remember at my old place of employment how the web server admin would always make me change the httpd-accessible file upload directories so that they were owned by apache:apache or nobody:nobody.
He said this was for security reasons.
Question: Can you tell me what specifically were the security implications of this? Also is there a way to get apache to run as nobody:nobody, and are there security implications for that as well?
TIA
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
有一个合理的理由，假设httpd（Apache）由root拥有并且也属于root组，并且在代码本身中发现了一个漏洞，例如，恶意用户请求了一个更长的URL超出预期并且 httpd 段出现故障。现在，该漏洞已经暴露了根访问权限，这意味着它可以控制系统，因此恶意用户最终将夺取控制权并对系统造成严重破坏。
这就是为什么 httpd 守护进程的所有权在 nobody:nobody 或 apache:apache 下运行的原因。它是一种有效的预防措施，可确保任何利用/漏洞都不会暴露 root 访问权限。想象一下如果这种情况发生的话，将会产生怎样的安全影响。
幸运的是，现在，根据 Linux 发行版、BSD 变体（OpenBSD/FreeBSD/NetBSD）或商业 Unix 变体，httpd 守护进程在具有最小权限的用户组下运行。此外，可以肯定地说，许多 Apache 代码已经过充分的测试并且稳定。所有域中大约 49% 的服务器都在运行 Apache。 29% 的域运行着 Microsoft 的 IIS。这是根据 netcraft 调查网站此处得出的。
在另一种情况下，它表明让程序在最低权限下运行将被视为“安全”，并减少任何可能的漏洞利用机会。
There is a valid reason, supposing the httpd (Apache) was owned by root and belongs to the group root also, and that there was a vulnerability that was found in the code itself, for example, a malicious user requested a URL that is longer than expected and the httpd seg-faulted. Now, that exploit has uncovered root access which means, it has control over the system and hence a malicious user would ultimately seize control and create havoc on the box.
That is a reason why the ownership of the httpd daemon runs under nobody:nobody or apache:apache. It is effectively a preventative measure to ensure that no exploit/vulnerability will expose root access. Imagine the security implications if that was to happen.
Fortunately, now, depending on the Linux distribution, BSD variants (OpenBSD/FreeBSD/NetBSD) or the commercial Unix variants, the httpd daemon runs under a user group that has the least privileges. And furthermore, it would be safe to say that a lot of the Apache code has been well tested enough and stable. About 49% of servers across all domains are running Apache. Microsoft's IIS runs at 29% of the domains. This is according the the netcraft survey site here.
In another context, it shows that having a program running under least privileges would be deemed 'safe' and mitigates any possible chances of exploits, vulnerabilites.
这个问题的网站是错误的。通常，您不希望源代码与 Apache 属于同一用户。如果 Apache 或服务器端脚本中出现安全缺陷，攻击者可能会恶意修改您网站的文件，而无需提升权限。
正如您所说，一个例外是文件上传目录。在本例中，您希望 Apache 更改该目录。
This is the wrong site for this question. Ordinarily you would not want the source code to be owned by the same user as Apache. Should a security flaw in Apache or your server-side scripts arise, an attacker could maliciously modify your web site's files without privilege escalation.
The one exception would be file upload directories, as you said. In this case, you want Apache to make changes to that directory.