On my server (Windows Server 2008 R2), I have installed a couple of programs coming with a web interface. As I want to be able to access those web interfaces from outside my LAN, the relevant ports are opened in the Windows Firewall and forwarded in my router.

Most of those programs realize their web frontend using an integrated Apache web server. In the default configuration, this web server is installed to run as a Windows Service under the user account "LOCAL-SYSTEM".

However, I am wondering, if I could improve security by changing the user account those service run. I have tried this with one of those applications with mixed success: It was really a hassle to figure out for which directories the user account needs read and/or write permissions.

Is that worth the effort?
Does running Apache under a more restricted user account actually increase security or is the default configuration "secure enough"?

  • This depends on what software you run with the webserver (php,cgi,just html). The simple answer is to implement the service with the least amount of permissions necessary to do the work and balance that against the 'Keep it simple stupid' principle. Is your time better spent on other projects, can you sleep at night knowing there might be holes that someone might find, does the 'cost' of securing the service out weigh the cost of recovery from a breach? ... ... ... It's a personal call you'll have to make to strike a balance. – Daniel Widrick Jul 13 '13 at 2:04
  • So not using a separate account could also be justifiable? I just don't won't to leave the server vulnerable to common attacks by employing a "bad practise". – Matthias Jul 13 '13 at 2:13
  • Your question is subjective. We don't know what programs you are running, what the web interface software is, and what kind of environment you are in. If you are working in a Department of Defense office doing something even as low key as hosting funny pictures of cats, you'll want to lock the thing down because of the environment. If this is a home server just running a few programs, that might also have pictures of grandma somewhere on the harddrive: 1) super userexchange 2) I wouldn't worry too much about security 3) ALWAYS be sure to backup those pictures of grandma and store them offsite. – Daniel Widrick Jul 13 '13 at 2:18

The possible consequences of this include an attacker being able to access any files on the server and even use all the privileges of the security principal it is running under. This would require a bug or nasty misconfiguration, but it is certainly possible.

The reason you drop privileges is so that if an attacker does get a shell or similar, they are limited to dumping the configuration (possibly) and the webroot, and can't write to anything the HTTP daemon (apache) can't write to.

Personally, I would strongly advise putting in the effort to getting it running as an unprivileged user, if you must run it under windows at all. This is especially true if you would suffer a loss due to a website defacement or if there are other services running on the server, or if the server could be used as a gateway to other things on your network.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.