Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In setting up an apache web server on my linux box, I've been told to make a separate user who has permission to use (and whose home directory is) the files in the /www directory. Additionally, I've made a mySQL user. Both of these users have the nologin attribute.

I have very little idea what I'm doing here, and I'm mostly doing testing via http://localhost, so I've been working mostly from my user account.

What I would like to know is as follows:

1) Generally, why do these users exist?

2) Does apache, mySQL or php access the privileges of these users?

3) Under what circumstances would I access the privileges of these users?

4) Why do they need the nologin attribute?

5) Any other relevant information that I didn't know to ask about.

Thanks.

share|improve this question
add comment

1 Answer 1

up vote 7 down vote accepted

In brief...

  1. Separate users does exactly that - it keeps things separate so that one user can't access or modify another user's files, depending on the permissions that user has set on their files. Many daemons (including Apache) run under a particular user account - for instance, Red Hat tends to use the 'apache' user, whereas Debian uses 'www-data'. This means that the daemon is treated like any other user - it can't access files it's not allowed to, unlike the root user
  2. Apache does, because it's reading the files off the filesystem, again like any other user. Because PHP is usually run as a module within Apache, it's also subject to the same restrictions. MySQL, however, has a separate authentication scheme, so there's no implied correlation between local users and database users
  3. If you're creating a separate user just for your web content, you'd be accessing that user to modify the files owned by that user - presumably your web content.
  4. By 'nologin attribute' I'm assuming you mean that the shell is set to /sbin/nologin - this prevents the user from logging in interactively, i.e. they can't SSH to the server or log in on the console.
  5. To be honest, it's not something that can be covered in a few lines. There's quite a few guides dotted around the internet aimed at beginners - have a read through a few and get a feel for it!
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.