1<?xml version="1.0" encoding="ISO-8859-1"?> 2<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> 3<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><!-- 4 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 5 This file is generated from xml source: DO NOT EDIT 6 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 7 --> 8<title>mod_privileges - Apache HTTP Server</title> 9<link href="/style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" /> 10<link href="/style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" /> 11<link href="/style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="/style/css/prettify.css" /> 12<script src="/style/scripts/prettify.min.js" type="text/javascript"> 13</script> 14 15<link href="/images/favicon.ico" rel="shortcut icon" /></head> 16<body> 17<div id="page-header"> 18<p class="menu"><a href="/mod/">Modules</a> | <a href="/mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="/glossary.html">Glossary</a> | <a href="/sitemap.html">Sitemap</a></p> 19<p class="apache">Apache HTTP Server Version 2.4</p> 20<img alt="" src="/images/feather.gif" /></div> 21<div class="up"><a href="./"><img title="<-" alt="<-" src="/images/left.gif" /></a></div> 22<div id="path"> 23<a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.4</a> > <a href="./">Modules</a></div> 24<div id="page-content"> 25<div id="preamble"><h1>Apache Module mod_privileges</h1> 26<div class="toplang"> 27<p><span>Available Languages: </span><a href="/en/mod/mod_privileges.html" title="English"> en </a> | 28<a href="/fr/mod/mod_privileges.html" hreflang="fr" rel="alternate" title="Fran�ais"> fr </a></p> 29</div> 30<table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Support for Solaris privileges and for running virtual hosts 31under different user IDs.</td></tr> 32<tr><th><a href="module-dict.html#Status">Status:</a></th><td>Experimental</td></tr> 33<tr><th><a href="module-dict.html#ModuleIdentifier">Module�Identifier:</a></th><td>privileges_module</td></tr> 34<tr><th><a href="module-dict.html#SourceFile">Source�File:</a></th><td>mod_privileges.c</td></tr> 35<tr><th><a href="module-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache 2.3 and up, on Solaris 10 and 36OpenSolaris platforms</td></tr></table> 37<h3>Summary</h3> 38 39<p>This module enables different Virtual Hosts to run with different 40Unix <var>User</var> and <var>Group</var> IDs, and with different 41<a href="http://sosc-dr.sun.com/bigadmin/features/articles/least_privilege.jsp">Solaris Privileges</a>. In particular, it offers a solution to the 42problem of privilege separation between different Virtual Hosts, first 43promised by the abandoned perchild MPM. It also offers other security 44enhancements.</p> 45 46<p>Unlike perchild, <code class="module"><a href="/mod/mod_privileges.html">mod_privileges</a></code> 47is not itself an MPM. It works <em>within</em> a processing model to 48set privileges and User/Group <em>per request</em> in a running process. 49It is therefore not compatible with a threaded MPM, and will refuse 50to run under one.</p> 51 52<p><code class="module"><a href="/mod/mod_privileges.html">mod_privileges</a></code> raises security issues similar to 53those of <a href="/suexec.html">suexec</a>. But unlike suexec, 54it applies not only to CGI programs but to the entire request processing 55cycle, including in-process applications and subprocesses. 56It is ideally suited to running PHP applications under <strong>mod_php</strong>, 57which is also incompatible with threaded MPMs. It is also well-suited 58to other in-process scripting applications such as <strong>mod_perl</strong>, 59<strong>mod_python</strong>, and <strong>mod_ruby</strong>, and to 60applications implemented in C as apache modules where privilege 61separation is an issue.</p> 62 63</div> 64<div id="quickview"><h3 class="directives">Directives</h3> 65<ul id="toc"> 66<li><img alt="" src="/images/down.gif" /> <a href="#dtraceprivileges">DTracePrivileges</a></li> 67<li><img alt="" src="/images/down.gif" /> <a href="#privilegesmode">PrivilegesMode</a></li> 68<li><img alt="" src="/images/down.gif" /> <a href="#vhostcgimode">VHostCGIMode</a></li> 69<li><img alt="" src="/images/down.gif" /> <a href="#vhostcgiprivs">VHostCGIPrivs</a></li> 70<li><img alt="" src="/images/down.gif" /> <a href="#vhostgroup">VHostGroup</a></li> 71<li><img alt="" src="/images/down.gif" /> <a href="#vhostprivs">VHostPrivs</a></li> 72<li><img alt="" src="/images/down.gif" /> <a href="#vhostsecure">VHostSecure</a></li> 73<li><img alt="" src="/images/down.gif" /> <a href="#vhostuser">VHostUser</a></li> 74</ul> 75<h3>Topics</h3> 76<ul id="topics"> 77<li><img alt="" src="/images/down.gif" /> <a href="#security">Security Considerations</a></li> 78</ul><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div> 79<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div> 80<div class="section"> 81<h2><a name="security" id="security">Security Considerations</a></h2> 82 83<p><code class="module"><a href="/mod/mod_privileges.html">mod_privileges</a></code> introduces new security concerns 84in situations where <strong>untrusted code</strong> may be run 85<strong>within the webserver process</strong>. This applies to 86untrusted modules, and scripts running under modules such as 87mod_php or mod_perl. Scripts running externally (e.g. as CGI 88or in an appserver behind mod_proxy or mod_jk) are NOT affected.</p> 89 90<p>The basic security concerns with mod_privileges are:</p> 91<ul><li>Running as a system user introduces the same security issues 92 as mod_suexec, and near-equivalents such as cgiwrap and suphp.</li> 93<li>A privileges-aware malicious user extension (module or script) 94 could escalate its privileges to anything available to the 95 httpd process in any virtual host. This introduces new risks 96 if (and only if) mod_privileges is compiled with the 97 <var>BIG_SECURITY_HOLE</var> option.</li> 98<li>A privileges-aware malicious user extension (module or script) 99 could escalate privileges to set its user ID to another system 100 user (and/or group).</li> 101</ul> 102 103<p>The <code class="directive">PrivilegesMode</code> directive allows you to 104select either <var>FAST</var> or <var>SECURE</var> mode. You can 105mix modes, using <var>FAST</var> mode for trusted users and 106fully-audited code paths, while imposing SECURE mode where an 107untrusted user has scope to introduce code.</p> 108<p>Before describing the modes, we should also introduce the target 109use cases: Benign vs Hostile. In a benign situation, you want to 110separate users for their convenience, and protect them and the server 111against the risks posed by honest mistakes, but you trust your users 112are not deliberately subverting system security. In a hostile 113situation - e.g. commercial hosting - you may have users deliberately 114attacking the system or each other.</p> 115<dl> 116<dt>FAST mode</dt> 117<dd>In <var>FAST</var> mode, requests are run in-process with the 118selected uid/gid and privileges, so the overhead is negligible. 119This is suitable for benign situations, but is not secure against an 120attacker escalating privileges with an in-process module or script.</dd> 121<dt>SECURE mode</dt> 122<dd>A request in <var>SECURE</var> mode forks a subprocess, which 123then drops privileges. This is a very similar case to running CGI 124with suexec, but for the entire request cycle, and with the benefit 125of fine-grained control of privileges.</dd> 126</dl> 127<p>You can select different <code class="directive">PrivilegesMode</code>s for 128each virtual host, and even in a directory context within a virtual 129host. <var>FAST</var> mode is appropriate where the user(s) are 130trusted and/or have no privilege to load in-process code. 131<var>SECURE</var> mode is appropriate to cases where untrusted code 132might be run in-process. However, even in <var>SECURE</var> mode, 133there is no protection against a malicious user who is able to 134introduce privileges-aware code running <em>before the start of the 135request-processing cycle.</em></p> 136 137</div> 138<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div> 139<div class="directive-section"><h2><a name="DTracePrivileges" id="DTracePrivileges">DTracePrivileges</a> <a name="dtraceprivileges" id="dtraceprivileges">Directive</a></h2> 140<table class="directive"> 141<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Determines whether the privileges required by dtrace are enabled.</td></tr> 142<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>DTracePrivileges On|Off</code></td></tr> 143<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>DTracePrivileges Off</code></td></tr> 144<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr> 145<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Experimental</td></tr> 146<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_privileges</td></tr> 147<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available on Solaris 10 and OpenSolaris with 148non-threaded MPMs (<code class="module"><a href="/mod/prefork.html">prefork</a></code> or custom MPM).</td></tr> 149</table> 150 <p>This server-wide directive determines whether Apache will run with 151 the <a href="http://sosc-dr.sun.com/bigadmin/features/articles/least_privilege.jsp">privileges</a> required to run 152 <a href="http://sosc-dr.sun.com/bigadmin/content/dtrace/">dtrace</a>. 153 Note that <var>DTracePrivileges On</var> will not in itself 154 activate DTrace, but <var>DTracePrivileges Off</var> will prevent 155 it working.</p> 156 157</div> 158<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div> 159<div class="directive-section"><h2><a name="PrivilegesMode" id="PrivilegesMode">PrivilegesMode</a> <a name="privilegesmode" id="privilegesmode">Directive</a></h2> 160<table class="directive"> 161<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Trade off processing speed and efficiency vs security against 162malicious privileges-aware code.</td></tr> 163<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>PrivilegesMode FAST|SECURE|SELECTIVE</code></td></tr> 164<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>PrivilegesMode FAST</code></td></tr> 165<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host, directory</td></tr> 166<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Experimental</td></tr> 167<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_privileges</td></tr> 168<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available on Solaris 10 and OpenSolaris with 169non-threaded MPMs (<code class="module"><a href="/mod/prefork.html">prefork</a></code> or custom MPM).</td></tr> 170</table><p>This directive trades off performance vs security against 171malicious, privileges-aware code. In <var>SECURE</var> mode, each request 172runs in a secure subprocess, incurring a substantial performance penalty. 173In <var>FAST</var> mode, the server is not protected against escalation 174of privileges as discussed above.</p> 175<p>This directive differs slightly between a <code><Directory></code> 176 context (including equivalents such as Location/Files/If) and a 177 top-level or <code><VirtualHost></code>.</p> 178<p>At top-level, it sets a default that will be inherited by virtualhosts. 179 In a virtual host, FAST or SECURE mode acts on the entire 180 HTTP request, and any settings in a <code><Directory></code> 181 context will be <strong>ignored</strong>. A third pseudo-mode 182 SELECTIVE defers the choice of FAST vs SECURE to directives in a 183 <code><Directory></code> context.</p> 184<p>In a <code><Directory></code> context, it is applicable only 185 where SELECTIVE mode was set for the VirtualHost. Only 186 FAST or SECURE can be set in this context (SELECTIVE would be 187meaningless).</p> 188<div class="warning"><h3>Warning</h3> 189 Where SELECTIVE mode is selected for a virtual host, the activation 190 of privileges must be deferred until <em>after</em> the mapping 191 phase of request processing has determined what 192 <code><Directory></code> context applies to the request. 193 This might give an attacker opportunities to introduce 194 code through a <code class="directive"><a href="/mod/mod_rewrite.html#rewritemap">RewriteMap</a></code> 195 running at top-level or <code><VirtualHost></code> context 196 <em>before</em> privileges have been dropped and userid/gid set. 197</div> 198 199</div> 200<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div> 201<div class="directive-section"><h2><a name="VHostCGIMode" id="VHostCGIMode">VHostCGIMode</a> <a name="vhostcgimode" id="vhostcgimode">Directive</a></h2> 202<table class="directive"> 203<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Determines whether the virtualhost can run 204subprocesses, and the privileges available to subprocesses.</td></tr> 205<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>VHostCGIMode On|Off|Secure</code></td></tr> 206<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>VHostCGIMode On</code></td></tr> 207<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>virtual host</td></tr> 208<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Experimental</td></tr> 209<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_privileges</td></tr> 210<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available on Solaris 10 and OpenSolaris with 211non-threaded MPMs (<code class="module"><a href="/mod/prefork.html">prefork</a></code> or custom MPM).</td></tr> 212</table> 213 <p>Determines whether the virtual host is allowed to run fork and exec, 214 the <a href="http://sosc-dr.sun.com/bigadmin/features/articles/least_privilege.jsp">privileges</a> required to run subprocesses. If this is set to 215 <var>Off</var> the virtualhost is denied the privileges and will not 216 be able to run traditional CGI programs or scripts under the traditional 217 <code class="module"><a href="/mod/mod_cgi.html">mod_cgi</a></code>, nor similar external programs such as those 218 created by <code class="module"><a href="/mod/mod_ext_filter.html">mod_ext_filter</a></code> or 219 <code class="directive"><a href="/mod/mod_rewrite.html#rewritemap">RewriteMap</a></code> <var>prog</var>. 220 Note that it does not prevent CGI programs running under alternative 221 process and security models such as <a href="http://fastcgi.coremail.cn">mod_fcgid</a>, which is a recommended solution in Solaris.</p> 222 <p>If set to <var>On</var> or <var>Secure</var>, the virtual host 223 is permitted to run external programs and scripts as above. 224 Setting <code class="directive">VHostCGIMode</code> <var>Secure</var> has 225 the effect of denying privileges to the subprocesses, as described 226 for <code class="directive">VHostSecure</code>.</p> 227 228</div> 229<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div> 230<div class="directive-section"><h2><a name="VHostCGIPrivs" id="VHostCGIPrivs">VHostCGIPrivs</a> <a name="vhostcgiprivs" id="vhostcgiprivs">Directive</a></h2> 231<table class="directive"> 232<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Assign arbitrary privileges to subprocesses created 233by a virtual host.</td></tr> 234<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>VHostPrivs [+-]?<var>privilege-name</var> [[+-]?privilege-name] ...</code></td></tr> 235<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>None</code></td></tr> 236<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>virtual host</td></tr> 237<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Experimental</td></tr> 238<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_privileges</td></tr> 239<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available on Solaris 10 and OpenSolaris with 240non-threaded MPMs (<code class="module"><a href="/mod/prefork.html">prefork</a></code> or custom MPM) 241and when <code class="module"><a href="/mod/mod_privileges.html">mod_privileges</a></code> is compiled with the 242<var>BIG_SECURITY_HOLE</var> compile-time option.</td></tr> 243</table> 244 <p><code class="directive">VHostCGIPrivs</code> can be used to assign arbitrary <a href="http://sosc-dr.sun.com/bigadmin/features/articles/least_privilege.jsp">privileges</a> to subprocesses created by a virtual host, as discussed 245 under <code class="directive">VHostCGIMode</code>. Each <var>privilege-name</var> 246 is the name of a Solaris privilege, such as <var>file_setid</var> 247 or <var>sys_nfs</var>.</p> 248 249 <p>A <var>privilege-name</var> may optionally be prefixed by 250 + or -, which will respectively allow or deny a privilege. 251 If used with neither + nor -, all privileges otherwise assigned 252 to the virtualhost will be denied. You can use this to override 253 any of the default sets and construct your own privilege set.</p> 254 255 <div class="warning"><h3>Security</h3> 256 <p>This directive can open huge security holes in apache subprocesses, 257 up to and including running them with root-level powers. Do not 258 use it unless you fully understand what you are doing!</p></div> 259 260</div> 261<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div> 262<div class="directive-section"><h2><a name="VHostGroup" id="VHostGroup">VHostGroup</a> <a name="vhostgroup" id="vhostgroup">Directive</a></h2> 263<table class="directive"> 264<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the Group ID under which a virtual host runs.</td></tr> 265<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>VHostGroup <var>unix-groupid</var></code></td></tr> 266<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>Inherits the group id specified in 267<code class="directive"><a href="/mod/mod_unixd.html#group">Group</a></code></code></td></tr> 268<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>virtual host</td></tr> 269<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Experimental</td></tr> 270<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_privileges</td></tr> 271<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available on Solaris 10 and OpenSolaris with 272non-threaded MPMs (<code class="module"><a href="/mod/prefork.html">prefork</a></code> or custom MPM).</td></tr> 273</table> 274 <p>The <code class="directive">VHostGroup</code> directive sets the Unix group 275 under which the server will process requests to a virtualhost. 276 The group is set before the request is processed and reset afterwards 277 using <a href="http://sosc-dr.sun.com/bigadmin/features/articles/least_privilege.jsp">Solaris Privileges</a>. Since the setting applies to the 278 <em>process</em>, this is not compatible with threaded MPMs.</p> 279 <p><var>Unix-group</var> is one of:</p> 280 <dl> 281 <dt>A group name</dt> 282 <dd>Refers to the given group by name.</dd> 283 284 <dt><code>#</code> followed by a group number.</dt> 285 <dd>Refers to a group by its number.</dd> 286 </dl> 287 288 <div class="warning"><h3>Security</h3> 289 <p>This directive cannot be used to run apache as root! 290 Nevertheless, it opens potential security issues similar to 291 those discussed in the <a href="/suexec.html">suexec</a> 292 documentation.</p></div> 293 294<h3>See also</h3> 295<ul> 296<li><code class="directive"><a href="/mod/mod_unixd.html#group">Group</a></code></li> 297<li><code class="directive"><a href="/mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code></li> 298</ul> 299</div> 300<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div> 301<div class="directive-section"><h2><a name="VHostPrivs" id="VHostPrivs">VHostPrivs</a> <a name="vhostprivs" id="vhostprivs">Directive</a></h2> 302<table class="directive"> 303<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Assign arbitrary privileges to a virtual host.</td></tr> 304<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>VHostPrivs [+-]?<var>privilege-name</var> [[+-]?privilege-name] ...</code></td></tr> 305<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>None</code></td></tr> 306<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>virtual host</td></tr> 307<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Experimental</td></tr> 308<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_privileges</td></tr> 309<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available on Solaris 10 and OpenSolaris with 310non-threaded MPMs (<code class="module"><a href="/mod/prefork.html">prefork</a></code> or custom MPM) 311and when <code class="module"><a href="/mod/mod_privileges.html">mod_privileges</a></code> is compiled with the 312<var>BIG_SECURITY_HOLE</var> compile-time option.</td></tr> 313</table> 314 <p><code class="directive">VHostPrivs</code> can be used to assign arbitrary <a href="http://sosc-dr.sun.com/bigadmin/features/articles/least_privilege.jsp">privileges</a> to a virtual host. Each <var>privilege-name</var> 315 is the name of a Solaris privilege, such as <var>file_setid</var> 316 or <var>sys_nfs</var>.</p> 317 318 <p>A <var>privilege-name</var> may optionally be prefixed by 319 + or -, which will respectively allow or deny a privilege. 320 If used with neither + nor -, all privileges otherwise assigned 321 to the virtualhost will be denied. You can use this to override 322 any of the default sets and construct your own privilege set.</p> 323 324 <div class="warning"><h3>Security</h3> 325 <p>This directive can open huge security holes in apache, up to 326 and including running requests with root-level powers. Do not 327 use it unless you fully understand what you are doing!</p></div> 328 329</div> 330<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div> 331<div class="directive-section"><h2><a name="VHostSecure" id="VHostSecure">VHostSecure</a> <a name="vhostsecure" id="vhostsecure">Directive</a></h2> 332<table class="directive"> 333<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Determines whether the server runs with enhanced security 334for the virtualhost.</td></tr> 335<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>VHostSecure On|Off</code></td></tr> 336<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>VHostSecure On</code></td></tr> 337<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>virtual host</td></tr> 338<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Experimental</td></tr> 339<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_privileges</td></tr> 340<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available on Solaris 10 and OpenSolaris with 341non-threaded MPMs (<code class="module"><a href="/mod/prefork.html">prefork</a></code> or custom MPM).</td></tr> 342</table> 343 <p>Determines whether the virtual host processes requests with 344 security enhanced by removal of <a href="http://sosc-dr.sun.com/bigadmin/features/articles/least_privilege.jsp">Privileges</a> that are rarely needed in a webserver, but which are 345 available by default to a normal Unix user and may therefore 346 be required by modules and applications. It is recommended that 347 you retain the default (On) unless it prevents an application running. 348 Since the setting applies to the <em>process</em>, this is not 349 compatible with threaded MPMs.</p> 350 <div class="note"><h3>Note</h3> 351 <p>If <code class="directive">VHostSecure</code> prevents an application 352 running, this may be a warning sign that the application should be 353 reviewed for security.</p></div> 354 355</div> 356<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div> 357<div class="directive-section"><h2><a name="VHostUser" id="VHostUser">VHostUser</a> <a name="vhostuser" id="vhostuser">Directive</a></h2> 358<table class="directive"> 359<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the User ID under which a virtual host runs.</td></tr> 360<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>VHostUser <var>unix-userid</var></code></td></tr> 361<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>Inherits the userid specified in 362<code class="directive"><a href="/mod/mod_unixd.html#user">User</a></code></code></td></tr> 363<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>virtual host</td></tr> 364<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Experimental</td></tr> 365<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_privileges</td></tr> 366<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available on Solaris 10 and OpenSolaris with 367non-threaded MPMs (<code class="module"><a href="/mod/prefork.html">prefork</a></code> or custom MPM).</td></tr> 368</table> 369 <p>The <code class="directive">VHostUser</code> directive sets the Unix userid 370 under which the server will process requests to a virtualhost. 371 The userid is set before the request is processed and reset afterwards 372 using <a href="http://sosc-dr.sun.com/bigadmin/features/articles/least_privilege.jsp">Solaris Privileges</a>. Since the setting applies to the 373 <em>process</em>, this is not compatible with threaded MPMs.</p> 374 <p><var>Unix-userid</var> is one of:</p> 375 <dl> 376 <dt>A username</dt> 377 <dd>Refers to the given user by name.</dd> 378 379 <dt><code>#</code> followed by a user number.</dt> 380 <dd>Refers to a user by its number.</dd> 381 </dl> 382 383 <div class="warning"><h3>Security</h3> 384 <p>This directive cannot be used to run apache as root! 385 Nevertheless, it opens potential security issues similar to 386 those discussed in the <a href="/suexec.html">suexec</a> 387 documentation.</p></div> 388 389<h3>See also</h3> 390<ul> 391<li><code class="directive"><a href="/mod/mod_unixd.html#user">User</a></code></li> 392<li><code class="directive"><a href="/mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code></li> 393</ul> 394</div> 395</div> 396<div class="bottomlang"> 397<p><span>Available Languages: </span><a href="/en/mod/mod_privileges.html" title="English"> en </a> | 398<a href="/fr/mod/mod_privileges.html" hreflang="fr" rel="alternate" title="Fran�ais"> fr </a></p> 399</div><div class="top"><a href="#page-header"><img src="/images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div> 400<script type="text/javascript"><!--//--><![CDATA[//><!-- 401var comments_shortname = 'httpd'; 402var comments_identifier = 'http://httpd.apache.org/docs/2.4/mod/mod_privileges.html'; 403(function(w, d) { 404 if (w.location.hostname.toLowerCase() == "httpd.apache.org") { 405 d.write('<div id="comments_thread"><\/div>'); 406 var s = d.createElement('script'); 407 s.type = 'text/javascript'; 408 s.async = true; 409 s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier; 410 (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s); 411 } 412 else { 413 d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>'); 414 } 415})(window, document); 416//--><!]]></script></div><div id="footer"> 417<p class="apache">Copyright 2014 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p> 418<p class="menu"><a href="/mod/">Modules</a> | <a href="/mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="/glossary.html">Glossary</a> | <a href="/sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!-- 419if (typeof(prettyPrint) !== 'undefined') { 420 prettyPrint(); 421} 422//--><!]]></script> 423</body></html>
