Re: Debian Wheezy Compromised - www-data user is sending 1000 emails an hour

[Raffaele Morelli <raffaele.morelli@gmail.com>]

2013/12/23 Gilles Mocellin <gilles.mocellin@nuagelibre.org>

Le 23/12/2013 15:30, Raffaele Morelli a écrit :

2013/12/14 Lukasz Szybalski <szybalski@gmail.com>

[...]

root should not own files served by apache for any reason, that's really "dangerous"!

you should never do that...

Excuse-me, but I think you're wrong.
The only reason I see where a file served by a web server must not be root is if it's suid and the web server has the rights to write to it (by the group membership).

I think you should read man pages on shells and privileges first and what a user can do.

/r