From owner-freebsd-security@FreeBSD.ORG Sat Dec 4 06:24:28 2004 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2589716A4CE for ; Sat, 4 Dec 2004 06:24:28 +0000 (GMT) Received: from mxfep02.bredband.com (mxfep02.bredband.com [195.54.107.73]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3C26843D58 for ; Sat, 4 Dec 2004 06:24:27 +0000 (GMT) (envelope-from jesper@hackunite.net) Received: from mail.hackunite.net ([213.112.198.212] [213.112.198.212]) by mxfep02.bredband.com with SMTP id <20041204062426.TUBB6820.mxfep02.bredband.com@mail.hackunite.net> for ; Sat, 4 Dec 2004 07:24:26 +0100 Received: from 213.112.198.152 (SquirrelMail authenticated user z3l3zt@hackunite.net) by mail.hackunite.net with HTTP; Sat, 4 Dec 2004 07:24:27 +0100 (CET) Message-ID: <1164.213.112.198.152.1102141467.squirrel@mail.hackunite.net> Date: Sat, 4 Dec 2004 07:24:27 +0100 (CET) From: "Jesper Wallin" To: freebsd-security@freebsd.org MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Mailer: SquirrelMail 1.4.2 X-Priority: 3 Importance: Normal Subject: Is my Apache server running as the root user or not? X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Dec 2004 06:24:28 -0000 Heya.. By reading my /usr/local/etc/apache2/httpd.conf, I can find out that my Apache is running as the user "www" and the group "www" .. Yet, when I run sockstat, it tells me one of the forks are runned as root and listening on port 80 as well as the other forks are runned by www:www.. If I got a lot of users connecting to my server on port 80, will thier requests ever be answered by the root fork or the www:www forks? --- snip --- [root@ninja:~]# sockstat -l4p80 USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS www httpd 18149 3 tcp4 *:80 *:* www httpd 18148 3 tcp4 *:80 *:* www httpd 18147 3 tcp4 *:80 *:* www httpd 14055 3 tcp4 *:80 *:* www httpd 14054 3 tcp4 *:80 *:* www httpd 14053 3 tcp4 *:80 *:* www httpd 14052 3 tcp4 *:80 *:* www httpd 14051 3 tcp4 *:80 *:* root httpd 14050 3 tcp4 *:80 *:* [root@ninja:~]# --- snip --- Best regards, Jesper Wallin