Re: Debian Wheezy Compromised - www-data user is sending 1000 emails an hour

[Raffaele Morelli <raffaele.morelli@gmail.com>]

2013/12/24 PaulNM <debian@paulscrap.com>

On 12/24/2013 03:00 AM, Raffaele Morelli wrote:
>
> 2013/12/24 Reco <recoverym4n@gmail.com <mailto:recoverym4n@gmail.com>>

>
>      Hi.
>
>     On Tue, 24 Dec 2013 08:47:17 +0100
>     Raffaele Morelli <raffaele.morelli@gmail.com

>     <mailto:raffaele.morelli@gmail.com>> wrote:
>
>     > I think you should read man pages on shells and privileges first
>     and what a
>     > user can do.
>
>     Can you elaborate please how exactly serving root-owned file with
>     apache is a bad thing for security?
>
>
> php script is owned by root -> full system access

No, php script *RUN* by root -> full system access

php script run by www-data -> access to what www-data has access to.

Yes, I missed this point.

BTW, as I don't want to rewrite someone else system security rules, let's say that: MY best practice is to have www-data or any other NON-root user as the scripts owner. 

/r