1<?xml version="1.0" encoding="UTF-8"?> 2<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> 3<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head> 4<meta content="text/html; charset=UTF-8" http-equiv="Content-Type" /> 5<!-- 6 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 7 This file is generated from xml source: DO NOT EDIT 8 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 9 --> 10<title>mod_privileges - Apache HTTP Server Version 2.4</title> 11<link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" /> 12<link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" /> 13<link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="../style/css/prettify.css" /> 14<script src="../style/scripts/prettify.min.js" type="text/javascript"> 15</script> 16 17<link href="../images/favicon.ico" rel="shortcut icon" /></head> 18<body> 19<div id="page-header"> 20<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p> 21<p class="apache">Apache HTTP Server Version 2.4</p> 22<img alt="" src="../images/feather.png" /></div> 23<div class="up"><a href="./"><img title="<-" alt="<-" src="../images/left.gif" /></a></div> 24<div id="path"> 25<a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.4</a> > <a href="./">Modules</a></div> 26<div id="page-content"> 27<div id="preamble"><h1>Apache Module mod_privileges</h1> 28<div class="toplang"> 29<p><span>Available Languages: </span><a href="../en/mod/mod_privileges.html" title="English"> en </a> | 30<a href="../fr/mod/mod_privileges.html" hreflang="fr" rel="alternate" title="Français"> fr </a></p> 31</div> 32<table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Support for Solaris privileges and for running virtual hosts 33under different user IDs.</td></tr> 34<tr><th><a href="module-dict.html#Status">Status:</a></th><td>Experimental</td></tr> 35<tr><th><a href="module-dict.html#ModuleIdentifier">Module Identifier:</a></th><td>privileges_module</td></tr> 36<tr><th><a href="module-dict.html#SourceFile">Source File:</a></th><td>mod_privileges.c</td></tr> 37<tr><th><a href="module-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache 2.3 and up, on Solaris 10 and 38OpenSolaris platforms</td></tr></table> 39<h3>Summary</h3> 40 41<p>This module enables different Virtual Hosts to run with different 42Unix <var>User</var> and <var>Group</var> IDs, and with different 43<a href="http://sosc-dr.sun.com/bigadmin/features/articles/least_privilege.jsp">Solaris Privileges</a>. In particular, it offers a solution to the 44problem of privilege separation between different Virtual Hosts, first 45promised by the abandoned perchild MPM. It also offers other security 46enhancements.</p> 47 48<p>Unlike perchild, <code class="module"><a href="../mod/mod_privileges.html">mod_privileges</a></code> 49is not itself an MPM. It works <em>within</em> a processing model to 50set privileges and User/Group <em>per request</em> in a running process. 51It is therefore not compatible with a threaded MPM, and will refuse 52to run under one.</p> 53 54<p><code class="module"><a href="../mod/mod_privileges.html">mod_privileges</a></code> raises security issues similar to 55those of <a href="../suexec.html">suexec</a>. But unlike suexec, 56it applies not only to CGI programs but to the entire request processing 57cycle, including in-process applications and subprocesses. 58It is ideally suited to running PHP applications under <strong>mod_php</strong>, 59which is also incompatible with threaded MPMs. It is also well-suited 60to other in-process scripting applications such as <strong>mod_perl</strong>, 61<strong>mod_python</strong>, and <strong>mod_ruby</strong>, and to 62applications implemented in C as apache modules where privilege 63separation is an issue.</p> 64 65</div> 66<div id="quickview"><a href="https://www.apache.org/foundation/contributing.html" class="badge"><img src="https://www.apache.org/images/SupportApache-small.png" alt="Support Apache!" /></a><h3>Topics</h3> 67<ul id="topics"> 68<li><img alt="" src="../images/down.gif" /> <a href="#security">Security Considerations</a></li> 69</ul><h3 class="directives">Directives</h3> 70<ul id="toc"> 71<li><img alt="" src="../images/down.gif" /> <a href="#dtraceprivileges">DTracePrivileges</a></li> 72<li><img alt="" src="../images/down.gif" /> <a href="#privilegesmode">PrivilegesMode</a></li> 73<li><img alt="" src="../images/down.gif" /> <a href="#vhostcgimode">VHostCGIMode</a></li> 74<li><img alt="" src="../images/down.gif" /> <a href="#vhostcgiprivs">VHostCGIPrivs</a></li> 75<li><img alt="" src="../images/down.gif" /> <a href="#vhostgroup">VHostGroup</a></li> 76<li><img alt="" src="../images/down.gif" /> <a href="#vhostprivs">VHostPrivs</a></li> 77<li><img alt="" src="../images/down.gif" /> <a href="#vhostsecure">VHostSecure</a></li> 78<li><img alt="" src="../images/down.gif" /> <a href="#vhostuser">VHostUser</a></li> 79</ul> 80<h3>Bugfix checklist</h3><ul class="seealso"><li><a href="https://www.apache.org/dist/httpd/CHANGES_2.4">httpd changelog</a></li><li><a href="https://bz.apache.org/bugzilla/buglist.cgi?bug_status=__open__&list_id=144532&product=Apache%20httpd-2&query_format=specific&order=changeddate%20DESC%2Cpriority%2Cbug_severity&component=mod_privileges">Known issues</a></li><li><a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2&component=mod_privileges">Report a bug</a></li></ul><h3>See also</h3> 81<ul class="seealso"> 82<li><a href="#comments_section">Comments</a></li></ul></div> 83<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 84<div class="section"> 85<h2><a name="security" id="security">Security Considerations</a></h2> 86 87<p><code class="module"><a href="../mod/mod_privileges.html">mod_privileges</a></code> introduces new security concerns 88in situations where <strong>untrusted code</strong> may be run 89<strong>within the webserver process</strong>. This applies to 90untrusted modules, and scripts running under modules such as 91mod_php or mod_perl. Scripts running externally (e.g. as CGI 92or in an appserver behind mod_proxy or mod_jk) are NOT affected.</p> 93 94<p>The basic security concerns with mod_privileges are:</p> 95<ul><li>Running as a system user introduces the same security issues 96 as mod_suexec, and near-equivalents such as cgiwrap and suphp.</li> 97<li>A privileges-aware malicious user extension (module or script) 98 could escalate its privileges to anything available to the 99 httpd process in any virtual host. This introduces new risks 100 if (and only if) mod_privileges is compiled with the 101 <var>BIG_SECURITY_HOLE</var> option.</li> 102<li>A privileges-aware malicious user extension (module or script) 103 could escalate privileges to set its user ID to another system 104 user (and/or group).</li> 105</ul> 106 107<p>The <code class="directive">PrivilegesMode</code> directive allows you to 108select either <var>FAST</var> or <var>SECURE</var> mode. You can 109mix modes, using <var>FAST</var> mode for trusted users and 110fully-audited code paths, while imposing SECURE mode where an 111untrusted user has scope to introduce code.</p> 112<p>Before describing the modes, we should also introduce the target 113use cases: Benign vs Hostile. In a benign situation, you want to 114separate users for their convenience, and protect them and the server 115against the risks posed by honest mistakes, but you trust your users 116are not deliberately subverting system security. In a hostile 117situation - e.g. commercial hosting - you may have users deliberately 118attacking the system or each other.</p> 119<dl> 120<dt>FAST mode</dt> 121<dd>In <var>FAST</var> mode, requests are run in-process with the 122selected uid/gid and privileges, so the overhead is negligible. 123This is suitable for benign situations, but is not secure against an 124attacker escalating privileges with an in-process module or script.</dd> 125<dt>SECURE mode</dt> 126<dd>A request in <var>SECURE</var> mode forks a subprocess, which 127then drops privileges. This is a very similar case to running CGI 128with suexec, but for the entire request cycle, and with the benefit 129of fine-grained control of privileges.</dd> 130</dl> 131<p>You can select different <code class="directive">PrivilegesMode</code>s for 132each virtual host, and even in a directory context within a virtual 133host. <var>FAST</var> mode is appropriate where the user(s) are 134trusted and/or have no privilege to load in-process code. 135<var>SECURE</var> mode is appropriate to cases where untrusted code 136might be run in-process. However, even in <var>SECURE</var> mode, 137there is no protection against a malicious user who is able to 138introduce privileges-aware code running <em>before the start of the 139request-processing cycle.</em></p> 140 141</div> 142<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 143<div class="directive-section"><h2><a name="DTracePrivileges" id="DTracePrivileges">DTracePrivileges</a> <a name="dtraceprivileges" id="dtraceprivileges">Directive</a></h2> 144<table class="directive"> 145<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Determines whether the privileges required by dtrace are enabled.</td></tr> 146<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>DTracePrivileges On|Off</code></td></tr> 147<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>DTracePrivileges Off</code></td></tr> 148<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> 149<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Experimental</td></tr> 150<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_privileges</td></tr> 151<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available on Solaris 10 and OpenSolaris with 152non-threaded MPMs (<code class="module"><a href="../mod/prefork.html">prefork</a></code> or custom MPM).</td></tr> 153</table> 154 <p>This server-wide directive determines whether Apache will run with 155 the <a href="http://sosc-dr.sun.com/bigadmin/features/articles/least_privilege.jsp">privileges</a> required to run 156 <a href="http://sosc-dr.sun.com/bigadmin/content/dtrace/">dtrace</a>. 157 Note that <var>DTracePrivileges On</var> will not in itself 158 activate DTrace, but <var>DTracePrivileges Off</var> will prevent 159 it working.</p> 160 161</div> 162<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 163<div class="directive-section"><h2><a name="PrivilegesMode" id="PrivilegesMode">PrivilegesMode</a> <a name="privilegesmode" id="privilegesmode">Directive</a></h2> 164<table class="directive"> 165<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Trade off processing speed and efficiency vs security against 166malicious privileges-aware code.</td></tr> 167<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PrivilegesMode FAST|SECURE|SELECTIVE</code></td></tr> 168<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>PrivilegesMode FAST</code></td></tr> 169<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr> 170<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Experimental</td></tr> 171<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_privileges</td></tr> 172<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available on Solaris 10 and OpenSolaris with 173non-threaded MPMs (<code class="module"><a href="../mod/prefork.html">prefork</a></code> or custom MPM).</td></tr> 174</table><p>This directive trades off performance vs security against 175malicious, privileges-aware code. In <var>SECURE</var> mode, each request 176runs in a secure subprocess, incurring a substantial performance penalty. 177In <var>FAST</var> mode, the server is not protected against escalation 178of privileges as discussed above.</p> 179<p>This directive differs slightly between a <code><Directory></code> 180 context (including equivalents such as Location/Files/If) and a 181 top-level or <code><VirtualHost></code>.</p> 182<p>At top-level, it sets a default that will be inherited by virtualhosts. 183 In a virtual host, FAST or SECURE mode acts on the entire 184 HTTP request, and any settings in a <code><Directory></code> 185 context will be <strong>ignored</strong>. A third pseudo-mode 186 SELECTIVE defers the choice of FAST vs SECURE to directives in a 187 <code><Directory></code> context.</p> 188<p>In a <code><Directory></code> context, it is applicable only 189 where SELECTIVE mode was set for the VirtualHost. Only 190 FAST or SECURE can be set in this context (SELECTIVE would be 191meaningless).</p> 192<div class="warning"><h3>Warning</h3> 193 Where SELECTIVE mode is selected for a virtual host, the activation 194 of privileges must be deferred until <em>after</em> the mapping 195 phase of request processing has determined what 196 <code><Directory></code> context applies to the request. 197 This might give an attacker opportunities to introduce 198 code through a <code class="directive"><a href="../mod/mod_rewrite.html#rewritemap">RewriteMap</a></code> 199 running at top-level or <code><VirtualHost></code> context 200 <em>before</em> privileges have been dropped and userid/gid set. 201</div> 202 203</div> 204<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 205<div class="directive-section"><h2><a name="VHostCGIMode" id="VHostCGIMode">VHostCGIMode</a> <a name="vhostcgimode" id="vhostcgimode">Directive</a></h2> 206<table class="directive"> 207<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Determines whether the virtualhost can run 208subprocesses, and the privileges available to subprocesses.</td></tr> 209<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>VHostCGIMode On|Off|Secure</code></td></tr> 210<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>VHostCGIMode On</code></td></tr> 211<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>virtual host</td></tr> 212<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Experimental</td></tr> 213<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_privileges</td></tr> 214<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available on Solaris 10 and OpenSolaris with 215non-threaded MPMs (<code class="module"><a href="../mod/prefork.html">prefork</a></code> or custom MPM).</td></tr> 216</table> 217 <p>Determines whether the virtual host is allowed to run fork and exec, 218 the <a href="http://sosc-dr.sun.com/bigadmin/features/articles/least_privilege.jsp">privileges</a> required to run subprocesses. If this is set to 219 <var>Off</var> the virtualhost is denied the privileges and will not 220 be able to run traditional CGI programs or scripts under the traditional 221 <code class="module"><a href="../mod/mod_cgi.html">mod_cgi</a></code>, nor similar external programs such as those 222 created by <code class="module"><a href="../mod/mod_ext_filter.html">mod_ext_filter</a></code> or 223 <code class="directive"><a href="../mod/mod_rewrite.html#rewritemap">RewriteMap</a></code> <var>prog</var>. 224 Note that it does not prevent CGI programs running under alternative 225 process and security models such as <a href="https://httpd.apache.org/mod_fcgid/">mod_fcgid</a>, which is a recommended solution in Solaris.</p> 226 <p>If set to <var>On</var> or <var>Secure</var>, the virtual host 227 is permitted to run external programs and scripts as above. 228 Setting <code class="directive">VHostCGIMode</code> <var>Secure</var> has 229 the effect of denying privileges to the subprocesses, as described 230 for <code class="directive">VHostSecure</code>.</p> 231 232</div> 233<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 234<div class="directive-section"><h2><a name="VHostCGIPrivs" id="VHostCGIPrivs">VHostCGIPrivs</a> <a name="vhostcgiprivs" id="vhostcgiprivs">Directive</a></h2> 235<table class="directive"> 236<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Assign arbitrary privileges to subprocesses created 237by a virtual host.</td></tr> 238<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>VHostCGIPrivs [+-]?<var>privilege-name</var> [[+-]?privilege-name] ...</code></td></tr> 239<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>None</code></td></tr> 240<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>virtual host</td></tr> 241<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Experimental</td></tr> 242<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_privileges</td></tr> 243<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available on Solaris 10 and OpenSolaris with 244non-threaded MPMs (<code class="module"><a href="../mod/prefork.html">prefork</a></code> or custom MPM) 245and when <code class="module"><a href="../mod/mod_privileges.html">mod_privileges</a></code> is compiled with the 246<var>BIG_SECURITY_HOLE</var> compile-time option.</td></tr> 247</table> 248 <p><code class="directive">VHostCGIPrivs</code> can be used to assign arbitrary <a href="http://sosc-dr.sun.com/bigadmin/features/articles/least_privilege.jsp">privileges</a> to subprocesses created by a virtual host, as discussed 249 under <code class="directive">VHostCGIMode</code>. Each <var>privilege-name</var> 250 is the name of a Solaris privilege, such as <var>file_setid</var> 251 or <var>sys_nfs</var>.</p> 252 253 <p>A <var>privilege-name</var> may optionally be prefixed by 254 + or -, which will respectively allow or deny a privilege. 255 If used with neither + nor -, all privileges otherwise assigned 256 to the virtualhost will be denied. You can use this to override 257 any of the default sets and construct your own privilege set.</p> 258 259 <div class="warning"><h3>Security</h3> 260 <p>This directive can open huge security holes in apache subprocesses, 261 up to and including running them with root-level powers. Do not 262 use it unless you fully understand what you are doing!</p></div> 263 264</div> 265<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 266<div class="directive-section"><h2><a name="VHostGroup" id="VHostGroup">VHostGroup</a> <a name="vhostgroup" id="vhostgroup">Directive</a></h2> 267<table class="directive"> 268<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the Group ID under which a virtual host runs.</td></tr> 269<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>VHostGroup <var>unix-groupid</var></code></td></tr> 270<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>Inherits the group id specified in 271<code class="directive"><a href="../mod/mod_unixd.html#group">Group</a></code></code></td></tr> 272<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>virtual host</td></tr> 273<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Experimental</td></tr> 274<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_privileges</td></tr> 275<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available on Solaris 10 and OpenSolaris with 276non-threaded MPMs (<code class="module"><a href="../mod/prefork.html">prefork</a></code> or custom MPM).</td></tr> 277</table> 278 <p>The <code class="directive">VHostGroup</code> directive sets the Unix group 279 under which the server will process requests to a virtualhost. 280 The group is set before the request is processed and reset afterwards 281 using <a href="http://sosc-dr.sun.com/bigadmin/features/articles/least_privilege.jsp">Solaris Privileges</a>. Since the setting applies to the 282 <em>process</em>, this is not compatible with threaded MPMs.</p> 283 <p><var>Unix-group</var> is one of:</p> 284 <dl> 285 <dt>A group name</dt> 286 <dd>Refers to the given group by name.</dd> 287 288 <dt><code>#</code> followed by a group number.</dt> 289 <dd>Refers to a group by its number.</dd> 290 </dl> 291 292 <div class="warning"><h3>Security</h3> 293 <p>This directive cannot be used to run apache as root! 294 Nevertheless, it opens potential security issues similar to 295 those discussed in the <a href="../suexec.html">suexec</a> 296 documentation.</p></div> 297 298<h3>See also</h3> 299<ul> 300<li><code class="directive"><a href="../mod/mod_unixd.html#group">Group</a></code></li> 301<li><code class="directive"><a href="../mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code></li> 302</ul> 303</div> 304<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 305<div class="directive-section"><h2><a name="VHostPrivs" id="VHostPrivs">VHostPrivs</a> <a name="vhostprivs" id="vhostprivs">Directive</a></h2> 306<table class="directive"> 307<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Assign arbitrary privileges to a virtual host.</td></tr> 308<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>VHostPrivs [+-]?<var>privilege-name</var> [[+-]?privilege-name] ...</code></td></tr> 309<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>None</code></td></tr> 310<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>virtual host</td></tr> 311<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Experimental</td></tr> 312<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_privileges</td></tr> 313<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available on Solaris 10 and OpenSolaris with 314non-threaded MPMs (<code class="module"><a href="../mod/prefork.html">prefork</a></code> or custom MPM) 315and when <code class="module"><a href="../mod/mod_privileges.html">mod_privileges</a></code> is compiled with the 316<var>BIG_SECURITY_HOLE</var> compile-time option.</td></tr> 317</table> 318 <p><code class="directive">VHostPrivs</code> can be used to assign arbitrary <a href="http://sosc-dr.sun.com/bigadmin/features/articles/least_privilege.jsp">privileges</a> to a virtual host. Each <var>privilege-name</var> 319 is the name of a Solaris privilege, such as <var>file_setid</var> 320 or <var>sys_nfs</var>.</p> 321 322 <p>A <var>privilege-name</var> may optionally be prefixed by 323 + or -, which will respectively allow or deny a privilege. 324 If used with neither + nor -, all privileges otherwise assigned 325 to the virtualhost will be denied. You can use this to override 326 any of the default sets and construct your own privilege set.</p> 327 328 <div class="warning"><h3>Security</h3> 329 <p>This directive can open huge security holes in apache, up to 330 and including running requests with root-level powers. Do not 331 use it unless you fully understand what you are doing!</p></div> 332 333</div> 334<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 335<div class="directive-section"><h2><a name="VHostSecure" id="VHostSecure">VHostSecure</a> <a name="vhostsecure" id="vhostsecure">Directive</a></h2> 336<table class="directive"> 337<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Determines whether the server runs with enhanced security 338for the virtualhost.</td></tr> 339<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>VHostSecure On|Off</code></td></tr> 340<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>VHostSecure On</code></td></tr> 341<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>virtual host</td></tr> 342<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Experimental</td></tr> 343<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_privileges</td></tr> 344<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available on Solaris 10 and OpenSolaris with 345non-threaded MPMs (<code class="module"><a href="../mod/prefork.html">prefork</a></code> or custom MPM).</td></tr> 346</table> 347 <p>Determines whether the virtual host processes requests with 348 security enhanced by removal of <a href="http://sosc-dr.sun.com/bigadmin/features/articles/least_privilege.jsp">Privileges</a> that are rarely needed in a webserver, but which are 349 available by default to a normal Unix user and may therefore 350 be required by modules and applications. It is recommended that 351 you retain the default (On) unless it prevents an application running. 352 Since the setting applies to the <em>process</em>, this is not 353 compatible with threaded MPMs.</p> 354 <div class="note"><h3>Note</h3> 355 <p>If <code class="directive">VHostSecure</code> prevents an application 356 running, this may be a warning sign that the application should be 357 reviewed for security.</p></div> 358 359</div> 360<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 361<div class="directive-section"><h2><a name="VHostUser" id="VHostUser">VHostUser</a> <a name="vhostuser" id="vhostuser">Directive</a></h2> 362<table class="directive"> 363<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the User ID under which a virtual host runs.</td></tr> 364<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>VHostUser <var>unix-userid</var></code></td></tr> 365<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>Inherits the userid specified in 366<code class="directive"><a href="../mod/mod_unixd.html#user">User</a></code></code></td></tr> 367<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>virtual host</td></tr> 368<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Experimental</td></tr> 369<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_privileges</td></tr> 370<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available on Solaris 10 and OpenSolaris with 371non-threaded MPMs (<code class="module"><a href="../mod/prefork.html">prefork</a></code> or custom MPM).</td></tr> 372</table> 373 <p>The <code class="directive">VHostUser</code> directive sets the Unix userid 374 under which the server will process requests to a virtualhost. 375 The userid is set before the request is processed and reset afterwards 376 using <a href="http://sosc-dr.sun.com/bigadmin/features/articles/least_privilege.jsp">Solaris Privileges</a>. Since the setting applies to the 377 <em>process</em>, this is not compatible with threaded MPMs.</p> 378 <p><var>Unix-userid</var> is one of:</p> 379 <dl> 380 <dt>A username</dt> 381 <dd>Refers to the given user by name.</dd> 382 383 <dt><code>#</code> followed by a user number.</dt> 384 <dd>Refers to a user by its number.</dd> 385 </dl> 386 387 <div class="warning"><h3>Security</h3> 388 <p>This directive cannot be used to run apache as root! 389 Nevertheless, it opens potential security issues similar to 390 those discussed in the <a href="../suexec.html">suexec</a> 391 documentation.</p></div> 392 393<h3>See also</h3> 394<ul> 395<li><code class="directive"><a href="../mod/mod_unixd.html#user">User</a></code></li> 396<li><code class="directive"><a href="../mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code></li> 397</ul> 398</div> 399</div> 400<div class="bottomlang"> 401<p><span>Available Languages: </span><a href="../en/mod/mod_privileges.html" title="English"> en </a> | 402<a href="../fr/mod/mod_privileges.html" hreflang="fr" rel="alternate" title="Français"> fr </a></p> 403</div><div class="top"><a href="#page-header"><img src="../images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Libera.chat, or sent to our <a href="https://httpd.apache.org/lists.html">mailing lists</a>.</div> 404<script type="text/javascript"><!--//--><![CDATA[//><!-- 405var comments_shortname = 'httpd'; 406var comments_identifier = 'http://httpd.apache.org/docs/2.4/mod/mod_privileges.html'; 407(function(w, d) { 408 if (w.location.hostname.toLowerCase() == "httpd.apache.org") { 409 d.write('<div id="comments_thread"><\/div>'); 410 var s = d.createElement('script'); 411 s.type = 'text/javascript'; 412 s.async = true; 413 s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier; 414 (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s); 415 } 416 else { 417 d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>'); 418 } 419})(window, document); 420//--><!]]></script></div><div id="footer"> 421<p class="apache">Copyright 2022 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p> 422<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!-- 423if (typeof(prettyPrint) !== 'undefined') { 424 prettyPrint(); 425} 426//--><!]]></script> 427</body></html>
