Operation of the Apache webserver with a user account
The security of the system can be increased by the running the Apache webserver under a non-administrative user account.
After the standard installation of a windows-based Apache webserver this service is operated by the System account. Thereby you have a security risk, since eventually authorized System accounts will have access to the Apache webserver.
This configuration can be changed with the following procedure.
- Setup a user on the local user base of the server on which Apache webserver is to be installed.
- Assign a complicated password.
- Create the account on the conditions "User cannot change password" and "Password will not expire."
- In addition assign the user to the group NMAdmin.
- Give full access rights to the installation directory of Apache and all subdirectories. (Eventually, you can restrict the access to only necessary writing rights for the respective directories.)
- Call the service applets (e.g. through execution of "services.msc" under Windows 2000 or with Start ->System control-> services under NT 4.0).
- Selection of the service "Apache 2" and the card "register".
- Change the selection "local system account" to "this account".
- Select the user and password of step 1.
- After confirmation of this adjustment you will get a message, that the selected account has the new priviledges.
- Now you can restart the Apache 2 service.
Then the Apache webserver will run under the account.
Please observe that this will not work with NetMan as of version 3.7 anymore! The NetMan Webserver has to be run with the system account - otherwise NetMan anonymous users cannot log on!
|