Is there a way to start/restart/stop apache server on linux as non-root user?

Question

I'd like to know if it is possible for non-root user on linux (i'm using openSUSE) to run apache without using sudo command. Take into account that the user is in the same group as apache (wwwrun).
Thanks in advance.

Answer 1

The two problems I can think of that you need to overcome are:

1. Permissions on log files - these may well be already set to allow wwwrun to access them, but its often an issue.

2. Non root user accessing a privileged port (80) - not sure if/how you can change this.

Answer 2

You can run Apache as any user. Just make sure that it is set up to only use allowed resources (directories, files and most importantly listening on a non privileged port).

To have it appear on HTTP’s standard port 80 (which is priviledged) you will have to setup, as root a redirection to your real Apache server. The easiest way is probably using iptables. For example if your Apache server is listening on port 8080:

iptables -t nat -A PREROUTING -p tcp --dport 80 --syn -j REDIRECT --to-port 8080

If you can not configure the server like this (or have your sysadmin do that once for all) you will have to use a non privileged port (something like Listen 8080) and access it using an URL that looks like http://www.example.com:8080/

Answer 3

I think you should be able to do this by granting execute access to the group owning the Apache control program (e.g., "chmod g+x apachectl"). If this is doesn't work by itself try also setting the owner SUID bit on the program (something along the lines of "chmod u+s apachectl").

The first step allows users in your wwwrun group to execute the apachectl program. The second step makes it so that when the group runs the program, it runs with the program owners privileges.

Let me know if this works, I'm a little rusty with file execution SUID, but I can help look into it further if you still have problems.

Be sure you understand the consequences of setting the SUID bit before you do this though.

Answer 4

Short answer: No

The reason for it is that only root can bind ports below 1024.

Long answer: check out http://www.debian-administration.org/articles/386

Once you overcome the problem with the ports, I don't think there will be any more trouble. Just remember that the user that apache runs under need to have write-access to the log files and maybe some other files as well.

However, if you run it without sudo, the spawner will probably not be able to change the user, so apache will be being run as the user starting it, instead of the apache user.

But what is the reason you don't want to run sudo? It is only the spawner process that is being run as root, the rest of them are being run under the apache user.

Answer 5

The problems pointed out above by benlumley, i.e. log files and reserved ports, can easily be overcome by configuring the log directory and port in your httpd.conf.

Answer 6

You can "setuid" to allow non-root users to run apachectl as root (without having to authenticate as root).

Example

Edit: Should mention that you require root access to set this up in the first place :-)