Re: [users@httpd] Why is apache running after doing apachectl -k stop

2012-03-22 Thread Silviu Andrica
Thanks for the replies. I had the impression that apachetcl -k stop will not return until httpd stopped. Cheers, Silviu On Mar 22, 2012, at 23:45 , Daniel Ruggeri wrote: > On 3/22/2012 4:58 PM, Igor Cicimov wrote: >> Thats too fast not all threads can close in just miliseconds you know. >> Add "

[users@httpd] Configuration file effects on security

2012-02-03 Thread Silviu Andrica
Hi, I was wondering if you know any tool that checks how secure an Apache configuration is. I know about Nikto and W3AF, but those tools are targeted at web applications. I'm more interested in tools that target web servers. Also, can you recommend some Apache configurations / setups where Nikt

Re: [users@httpd] Opening ErrorLog as root and overwriting any file on the system

2011-11-24 Thread silviu andrica
Hi Igor, I think you are wrong. I wrote this simple program that does what I suggested: #include #include #include int main(int argc, char** argv){ uid_t low_uid = 1000; uid_t high_uid = getuid(); seteuid(low_uid); // drop privilege const char* fileName="test.txt"; FILE* file = fopen(fileNa

Re: [users@httpd] Opening ErrorLog as root and overwriting any file on the system

2011-11-24 Thread Silviu Andrica
> > What would it do when the file already exists and is owned by root? :) > > > It is hard to distinguish between "file owned by root, but we should > append to it" and "file owned by root and the admin made a mistake in > the conf file". The former is the usual case when starting a server > wi

Re: [users@httpd] Opening ErrorLog as root and overwriting any file on the system

2011-11-24 Thread Silviu Andrica
, Silviu On Nov 24, 2011, at 17:52 , Tom Evans wrote: > On Thu, Nov 24, 2011 at 3:53 PM, silviu andrica > wrote: >> Hi, >> >> I noticed that in Apache/2.2.20 (Ubuntu), the ErrorLog is opened as root, >> although the User is set to ${APACHE_RUN_USER}. >> My co

[users@httpd] Opening ErrorLog as root and overwriting any file on the system

2011-11-24 Thread silviu andrica
Hi, I noticed that in Apache/2.2.20 (Ubuntu), the ErrorLog is opened as root, although the User is set to ${APACHE_RUN_USER}. My concern is that if I make a mistake in ErrorLog, then I can damage any file on my system because of a stupid copy-paste error. I was wondering what is the reason Apache