New answers tagged root
Yes, that is a serious vulnerability. Never run apache or other web servers as root. You should make sure sudo is installed and set up the /etc/sudoers file so that www-data can run certain commands as root. I would recommend you create a wrapper around useradd, though, because user IDs can be specified on the command line, and you could end up with a ...
This doesn't work like that. sudo gives a user extended rights if they are requested by calling sudo, but you don't have those rights otherwise, and certainly not when connecting to a share via SFTP. What would work is e.g. sudo ls -l /sites, or sudo cp file /sites etc., but this isn't possible in a SFTP session. Read up on how sudo works.
It is generally considered good practice to disable root logins. Users should login with their own account, then use sudo. It is a very common attack vector to try to break root's password and therefore getting privileged access to your box. Your friend's box maybe configured to disable an account for a period of time if there has been too many failed ...
Top 50 recent answers are included