I will firstly answer questions 1 and 3 because 3 is a special case of 1, the question 2 is actually very simple but let's get our hands dirty!
We firstly perform Apache -specific modification with SED and then make sure Apache is really running with the intended
user:group that is
# sed -i s@APACHE_RUN_GROUP=www-data@APACHE_RUN_GROUP=web-content@g /etc/apache2/envvars
# /etc/init.d/apache2 restart
# ps -o pid,user,group,fname $(pidof apache2)
PID USER GROUP COMMAND
24514 root root apache2
24521 www-data 1001 apache2
24522 www-data 1001 apache2
24523 www-data 1001 apache2
24524 www-data 1001 apache2
# grep 1001 /etc/group
# getent group 1001
where we checked the correspondence of 1001 -placeholder with two different commands for sure so 1001 corresponds to web-content -group. One Apache -process must be running as
root:root because it needs to bind to the port 80, according to THE. So now your apache is running as
www-data:web-content. You can thank THE and SO for collaborating with this puzzle, welcome to #Debian -channel in Freenode.
There are actually many ways to Rome:
- using the start/stop -daemons in
But according to THE, there is no general way of accomplishing this
that would work over all platforms. You need to learn to use the right
tool at the right spot. For example, the starting point with Apache
-case was to investigate the
/etc/apache2/apache2.conf where you found out the
/etc/apache2/envvars -file, after reading the
comments. Then you just used the
-command and verified that the program is actually running with intended
For newbies, I warn about
setuid/setgid because easy security
-vulnerabilities unless done carefully -- use as you wish with your own machine but use proper auditing in production. But this is no
find -manual in Debian provided this tool that
may help you in auditing things, have fuN!
Traverse the filesystem just once, listing setuid files and
directories into /root/suid.txt and large files into /root/big.txt.
find $HOME -mtime 0
Now I have answered your points 1 and 3, about running a program with
user:group -combination including Apache (q3 was a special
case of question 1). So to the second question, a simple
will make sure that Apache -thing is working correctly like this:
# ls -lsa
4 drwxrwx--- 2 www-data web-content 4096 Aug 20 20:21 .
4 drwxrwx--- 6 www-data web-content 4096 Aug 14 22:20 ..
884 -rw-r--r-- 1 www-data web-content 900386 Aug 20 20:21 0_hhh.png
12 -rw-r--r-- 1 www-data web-content 8194 Aug 20 20:21 1_hhh.jpg
Happy puzzling :D
You may need the following commands. If you need to add the user
www-data into the
web-content -group, for example because you eventually found a nice fellow
A with whom you want to co-operate. They may help you in debugging if something goes wrong, work hard!
It will add the www-data -user into the web-content -group.
# usermod -a -G web-content www-data
It will show you the user of the process but not the group
# ps -aux|grep apache