blocks|key|1631081|text|通过在httpd.conf中配置日志目录和端口，可以轻松地克服本伦利上面指出的问题，即日志文件和保留端口。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1631082|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

The problems pointed out above by benlumley, i.e. log files and reserved ports, can easily be overcome by configuring the log directory and port in your httpd.conf.

blocks|key|1631235|text|如果您已经安装了sudo，您可以创建一个包含以下内容的文件:+/etc/suduers.d/apache2reload：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1631236|username++++ALL=NOPASSWD:/usr/bin/service+apache2+reload|code-block|syntax|javascript|1631237|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

If you have sudo installed you can create a file: /etc/suduers.d/apache2reload with the following content:

<pre><code>username ALL=NOPASSWD:/usr/bin/service apache2 reload
</code></pre>

blocks|key|1631032|text|简短的回答是:不|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1631033|原因是只有root才能绑定1024以下的端口。|1631034|冗长的答案:查看http://www.debian-administration.org/articles/386|offset|length|1631035|一旦你解决了端口的问题，我认为不会再有任何麻烦了。请记住，运行apache的用户需要拥有对日志文件的写访问权限，可能还需要对其他一些文件拥有写访问权限。|1631036|但是，如果在不使用sudo的情况下运行它，派生程序可能无法更改用户，因此apache将作为启动它的用户运行，而不是apache用户。|1631037|但是您不想运行sudo的原因是什么呢？只有spawner进程是以root用户身份运行的，其余进程都是以apache用户身份运行的。|1631038|entityMap|0|LINK|mutability|MUTABLE|url|http://www.debian-administration.org/articles/386^0|0|0|8|1D|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|V|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|W|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|X|8|@]|9|@$F|Y|G|Z|1|10]]|A|$]]|$1|H|3|I|5|6|7|11|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|12|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|13|8|@]|9|@]|A|$]]|$1|N|3|-4|5|6|7|14|8|@]|9|@]|A|$]]]|O|$P|$5|Q|R|S|A|$T|U]]]]

Short answer: No

The reason for it is that only root can bind ports below 1024. 

Long answer: check out <a href="http://www.debian-administration.org/articles/386" rel="noreferrer" title="http://www.debian-administration.org/articles/386">http://www.debian-administration.org/articles/386</a>

Once you overcome the problem with the ports, I don't think there will be any more trouble. Just remember that the user that apache runs under need to have write-access to the log files and maybe some other files as well.

However, if you run it without sudo, the spawner will probably not be able to change the user, so apache will be being run as the user starting it, instead of the apache user.

But what is the reason you don't want to run sudo? It is only the spawner process that is being run as root, the rest of them are being run under the apache user.

blocks|key|1416742|text|如果不想授予sudo访问权限，还可以创建一个setuid包装器程序。例如：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1416743|httpdctrl.c|1416744|#include+<stdio.h>
#include+<sys/types.h>
#include+<unistd.h>
#include+<signal.h>
#include+<strings.h>

//+allow+start/stop/restart+of+apache+by+non-root+users

int+main(int+argc,+char+**argv)
{
++char+*cmd,+*cmd2,+*usage;

++//+UPDATE+THIS+LINE:
++cmd+=+"/your/path/to/httpd/sbin/apachectl";
++cmd2+=+"apachectl";
++usage+=+"Usage:+COMMAND+[start%7Cstop%7Crestart]\n";

++if+(+argc+!=+2+)+{
++++printf(usage);
++++exit(1);
++}

++setegid(0);
++seteuid(0);
++setgid(0);
++setuid(0);

++if+(+strncmp(argv[1],+"start",+5)+==+0+)+{
++++if+(execl(cmd,+cmd2,+"start",+(char*)0)+<+0)+{
+++++perror("Error");
++++}
++}+else+if+(+strncmp(argv[1],+"stop",+4)+==+0+)+{
++++if+(execl(cmd,+cmd2,+"stop",+(char*)0)+<+0)+{
+++++perror("Error");
++++}
++}+else+if+(+strncmp(argv[1],+"restart",+7)+==+0+)+{
++++if+(execl(cmd,+cmd2,+"restart",+(char*)0)+<+0)+{
+++++perror("Error");
++++}
++}+else+{
++++printf(usage);
++++exit(1);
++}
++exit(0);
}|code-block|syntax|javascript|1416745|在以下位置更新路径：|1416746|++//+UPDATE+THIS+LINE:
++cmd+=+"/your/path/to/httpd/sbin/apachectl";|1416747|然后使用编译和更改权限|1416748|gcc+-o+httpdctrl+httpdctrl.c
sudo+chown+root:root+httpdctrl
sudo+chmod+u%2Bs+httpdctrl|1416749|现在httpdctrl归root所有，setuid将以root身份运行它。|1416750|重要提示:确保启动/停止脚本和所有父目录也归root所有。同时删除对“其他”文件和目录的写访问权限。基本上，您不希望有人能够编辑或更改使用root执行的目录/文件。|1416751|entityMap^0|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|X|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|Y|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|Z|8|@]|9|@]|A|$]]|$1|K|3|L|5|F|7|10|8|@]|9|@]|A|$G|H]]|$1|M|3|N|5|6|7|11|8|@]|9|@]|A|$]]|$1|O|3|P|5|F|7|12|8|@]|9|@]|A|$G|H]]|$1|Q|3|R|5|6|7|13|8|@]|9|@]|A|$]]|$1|S|3|T|5|6|7|14|8|@]|9|@]|A|$]]|$1|U|3|-4|5|6|7|15|8|@]|9|@]|A|$]]]|V|$]]

If you don't want to give out sudo access, you can also create a setuid wrapper program. For example:

httpdctrl.c

<pre><code>#include &lt;stdio.h&gt;
#include &lt;sys/types.h&gt;
#include &lt;unistd.h&gt;
#include &lt;signal.h&gt;
#include &lt;strings.h&gt;

// allow start/stop/restart of apache by non-root users

int main(int argc, char **argv)
{
 char *cmd, *cmd2, *usage;

 // UPDATE THIS LINE:
 cmd = "/your/path/to/httpd/sbin/apachectl";
 cmd2 = "apachectl";
 usage = "Usage: COMMAND [start|stop|restart]\n";

 if ( argc != 2 ) {
 printf(usage);
 exit(1);
 }

 setegid(0);
 seteuid(0);
 setgid(0);
 setuid(0);

 if ( strncmp(argv[1], "start", 5) == 0 ) {
 if (execl(cmd, cmd2, "start", (char*)0) &lt; 0) {
 perror("Error");
 }
 } else if ( strncmp(argv[1], "stop", 4) == 0 ) {
 if (execl(cmd, cmd2, "stop", (char*)0) &lt; 0) {
 perror("Error");
 }
 } else if ( strncmp(argv[1], "restart", 7) == 0 ) {
 if (execl(cmd, cmd2, "restart", (char*)0) &lt; 0) {
 perror("Error");
 }
 } else {
 printf(usage);
 exit(1);
 }
 exit(0);
}
</code></pre>

Update the path at:

<pre><code> // UPDATE THIS LINE:
 cmd = "/your/path/to/httpd/sbin/apachectl";
</code></pre>

Then compile and change permisions with

<pre><code>gcc -o httpdctrl httpdctrl.c
sudo chown root:root httpdctrl
sudo chmod u+s httpdctrl
</code></pre>

Now the httpdctrl is owned by root, and setuid will run it as root.

IMPORTANT: Make sure the start/stop script and all parent dirs are owned by root as well. Also remove write access to files and dirs for 'other'. Basically, you don't want someone to be able to edit or change the dirs/files that are executed with root.

blocks|key|1630967|text|我认为您应该能够通过授予拥有Apache控制程序的组(例如，"chmod+g%2Bx+apachectl")执行访问权限来做到这一点。如果这本身不起作用，还可以尝试在程序中设置所有者SUID位(类似于"chmod+u%2Bs+apachectl")。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1630968|第一步允许wwwrun组中的用户执行apachectl程序。第二步是，当组运行程序时，它将以程序所有者的权限运行。|1630969|让我知道这是否有效，我对文件执行SUID有点生疏，但如果您仍然有问题，我可以帮助您进一步研究它。|1630970|但是，在执行此操作之前，请务必了解设置SUID位的后果。|1630971|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|L|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|M|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

I think you should be able to do this by granting execute access to the group owning the Apache control program (e.g., "chmod g+x apachectl"). If this is doesn't work by itself try also setting the owner SUID bit on the program (something along the lines of "chmod u+s apachectl").

The first step allows users in your wwwrun group to execute the apachectl program. The second step makes it so that when the group runs the program, it runs with the program owners privileges.

Let me know if this works, I'm a little rusty with file execution SUID, but I can help look into it further if you still have problems.

Be sure you understand the consequences of setting the SUID bit before you do this though.

blocks|key|1416416|text|您可以使用"setuid“来允许非root用户以root用户身份运行apachectl+(而不必以root用户身份进行身份验证)。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1416417|Example|offset|length|1416418|Edit:首先应该提到您需要root访问权限才能进行设置:-)|1416419|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Setuid#Demonstration^0|0|0|7|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@]|9|@$D|R|E|S|1|T]]|A|$]]|$1|F|3|G|5|6|7|U|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|V|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|O]]]]

You can "setuid" to allow non-root users to run apachectl as root (without having to authenticate as root).

<a href="http://en.wikipedia.org/wiki/Setuid#Demonstration" rel="nofollow noreferrer">Example</a>

Edit: Should mention that you require root access to set this up in the first place :-)

blocks|key|1416537|text|您可以使用sudo+-l查看您的权限，从这里您可能会发现您可以访问重新启动命令，但可能无法启动和停止。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1416538|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

You can view your privileges with sudo -l, from here you might find that you have access to the restart command, but maybe not start and stop.

blocks|key|1631416|text|我找到的一些链接对此给出了最有益的答案。从技术上讲，它仍然充当根目录，但您可以chmod+u%2Bs+apache2和apache2ctl+(如果您也使用第二个根目录)加载文件。这允许你以根用户权限运行它们，但仍然是拥有相同权限的用户，保持安全性不变(除非apache或apache2ctl做更疯狂的事情，我对此表示怀疑)。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1631417|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Some link I found gave the most beneficial answer for this. Technically, it's still acting as root but you can chmod u+s the apache2 and apache2ctl (if you're also using the second) loading files. This allows you to run them with root access but still be of a user that holds the same permissions, keeping security intact (unless apache or apache2ctl were to do crazier things which I doubt they are).

blocks|key|1416664|text|您可以使用supervisor来运行apache|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1416665|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

you can use supervisor to run the apache

I'd like to know if it is possible for non-root user on linux (i'm using openSUSE) to run apache without using sudo command. Take into account that the user is in the same group as apache (wwwrun). 
Thanks in advance.

Is there a way to start/restart/stop apache server on linux as non-root user?

身份验证

日志文件

openSUSE

我想知道linux上的非根用户(我使用的是openSUSE)是否可以在不使用sudo命令的情况下运行apache。考虑到用户与apache在同一组中(wwwrun)。提前谢谢。

问有没有办法以非root用户的身份在linux上启动/重新启动/停止apache服务器？
EN

回答 9

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问有没有办法以非root用户的身份在linux上启动/重新启动/停止apache服务器？EN

回答 9

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问有没有办法以非root用户的身份在linux上启动/重新启动/停止apache服务器？
EN