Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For security, I created an apache user without shell and home directory in my system. Then I changed User directive from daemon to apache in httpd.conf. It creates sub processes in apache to run as apache user.

Why does my apache server still execute my cgi shell script with apache user without shell?

share|improve this question

Your apache user does not have a login shell or home directory. That is good.

However, "not having a shel" does not mean that the user cannot run shell scripts. That is something different entirely.

You have configured the httpd daemon to run as user "apache", so all processes it starts will also run as user "apache", including CGI cripts. And this is as intended.

share|improve this answer
    
Thank you Krist van Besien. Now I am confusing "not having a shell does not mean that the user cannot run shell scripts". I do not find myself the way to examine it on my system. Could you please make it clear ? – thekid May 17 '13 at 8:10
    
What I mean is that "not having a shell" does not have the meaning you seem to attach to it. When we say that a user doesn't have a shell this means that the user does not have a "login shell", ie that the user cannot log in to an interactive shell session. However a process running under such a user id can still start other processes. A CGI script can be a shell script (but id doesn't have to be) and in such a case apache will start a non interactive shell to run the script in. – Krist van Besien May 17 '13 at 13:31
    
Thank you again! I got it. I did an experiment to examine it. I sure apache user does not have any login shells. When I execute CGI, I find what process running the CGI. It is apache user. As you said, apache server cannot log in to an interactive shell but it is possible to start a non interactive shell follow shebang line declared in CGI script. Bash or sh shell both allow other to read and execute (0755) so apache user is able to do it. – thekid May 18 '13 at 18:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.