Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is for an unremarkable LAMP server running Ubuntu. The reason I want to do this is because I want a php script to be able to run a linux command via the exec() function and the command I want to run needs permission that 'nobody' does not have.I have added my new user 'web' with the appropriate permissions, now I just need my web server to be the user 'web'.

share|improve this question
up vote 4 down vote accepted

This is located in:

/etc/apache2/envvars

And is usually (by default):

export APACHE_RUN_USER=www-data
export APACHE_RUN_GROUP=www-data

You can change the user that apache runs as here. You'll need to restart apache for the changes to take.

What you really want is SUEXEC. What you're proposing is rather quick and dirty; it also poses a huge security risk.

What you should really be doing is this.

share|improve this answer
    
I wish "What you really want is SUEXEC." could be bigger and bolder! Exactly what I needed. Didn't see it at first. – larrylampco Feb 7 at 5:45

Have a look at suexec. Alternately you can set the user Apache runs as. This is an excerpt from my httpd.conf

# If you wish httpd to run as a different user or group, you must run
# httpd as root initially and it will switch.
#
# User/Group: The name (or #number) of the user/group to run httpd as.
# It is usually good practice to create a dedicated user and group for
# running httpd, as with most system services.
#
User www
Group www
share|improve this answer

I know this is coming late, but i stumbled upon this question when i was trying to solve a similar problem. I would suggest you run WHOIAM to determine the current user. Then grant the user the right permission using VISUDO

By default apache runs with the user www-data you can apply the permission in visudo by including the following line in /etc/sudoers

www-data ALL = NOPASSWD : /usr/local/bin 

you can replace /usr/local/bin with the command you want to run in your script.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.