Very Computer

Are there any security risks involved by assigning the name and group to a
actual user who will be maintaining the web server, yet do not have root
priviledges as oppose to "nobody" as the default user?

Eg.

httpd.conf
----------
User  joe
Group webmanager

Hola mundo.

[example deleted]

Well, a bug or security hole in a script can be used to wipe out
all the files in the server owned by "joe" or in group "webmanager".

Currently, only log files must be owned by "nobody" in NCSA's httpd,
and could be affected by a bug... (it is supposed that version 1.4.1
doesn't allow CGIs to access log files)

If your scripts are secure and well-writen, go ahead...

Bye...   ++Vitoco
--
Lic. Victor A. Parada                  __     __     Universidad Tecnica
Ingenieria Civil en Informatica     o-''))_____\\    Federico Santa Maria,

http://www.inf.utfsm.cl/~vparada/   c_c__/-c____/    +56 32 626364 x431 :-)

If user joe has mail or files in his home dir, and someone makes symlinks
to them, and you don't have that hole disabled, anyone can read his files.
Anyone who is allowed to install CGI scripts or can use EXEC CMD includes
basically has (can very easily have) shell access as joe, can trash joe's
files or modify/wipe out all your WWW pages.  Sounds like a potentially
bad idea, to me...unless you have complete trust in all the people who
have user accounts.

------------------------------------------------------------------
 Jon Lewis                      |  Mime attachments are OK

 http://inorganic5.chem.ufl.edu |  unsolicited huge files.
                                |