Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

For security, I create apache user without shell and home directory in my system. And then, I change User directive from daemon to apache in httpd.conf It makes sub processes in apache to run as apache user. But I do not know why apache server still execute my cgi shell script with apache user without shell.

Thank in advance.

P/S: Sorry about grammar mistakes in my post . My English is not good. I am studying English to improve it.

share|improve this question

1 Answer 1

Your apache user does not have a login shell or home directory. That is good.

However, "not having a shel" does not mean that the user cannot run shell scripts. That is something different entirely.

You have configured the httpd daemon to run as user "apache", so all processes it starts will also run as user "apache", including CGI cripts. And this is as intended.

share|improve this answer
    
Thank you Krist van Besien. Now I am confusing "not having a shell does not mean that the user cannot run shell scripts". I do not find myself the way to examine it on my system. Could you please make it clear ? –  thekid May 17 '13 at 8:10
    
What I mean is that "not having a shell" does not have the meaning you seem to attach to it. When we say that a user doesn't have a shell this means that the user does not have a "login shell", ie that the user cannot log in to an interactive shell session. However a process running under such a user id can still start other processes. A CGI script can be a shell script (but id doesn't have to be) and in such a case apache will start a non interactive shell to run the script in. –  Krist van Besien May 17 '13 at 13:31
    
Thank you again! I got it. I did an experiment to examine it. I sure apache user does not have any login shells. When I execute CGI, I find what process running the CGI. It is apache user. As you said, apache server cannot log in to an interactive shell but it is possible to start a non interactive shell follow shebang line declared in CGI script. Bash or sh shell both allow other to read and execute (0755) so apache user is able to do it. –  thekid May 18 '13 at 18:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.