Mailing List Archive

In message <20061004143906.GA11126 at trig.com>, "Benny Kjellgren (TRIG/adocca)" write
s:
>Hi,
>
>I have started to test Varnish on Debian (and Archlinux) and the
>first thing I was looking for is to how to run Varnish as a none
>root user (eg www-data) and/or put it in a jail (chroot).
>
>Is it possible to do that ?

If you don't use a priviledged listen port, it should just work.

--
Poul-Henning Kamp | UNIX since Zilog Zeus 3.20
phk at FreeBSD.ORG | TCP/IP since RFC 956
FreeBSD committer | BSD since 4.3-tahoe
Never attribute to malice what can adequately be explained by incompetence.

* Benny Kjellgren
>> I have started to test Varnish on Debian (and Archlinux) and the
>> first thing I was looking for is to how to run Varnish as a none
>> root user (eg www-data) and/or put it in a jail (chroot).
>>
>> Is it possible to do that ?

* Poul-Henning Kamp
> If you don't use a priviledged listen port, it should just work.

Any plans to use the model used by eg apache or squid, with a
dispatching process running in priviledged mode, and process children
running with a non privilegded user?

One might think that this model makes privilege escalation harder, or at
least, less intrusive, in case there should be any exploitable bugs in
varnish (but of course, there would never be any such thing 8-) .

Ingvar

--
When everything else fails: Symlink

> Any plans to use the model used by eg apache or squid, with a
> dispatching process running in priviledged mode, and process children
> running with a non privilegded user?

An other example is Pound
http://www.apsis.ch/pound/
In Pound you can set "User", "Group" and "RootJail".

--
Benny Kjellgren

> If you don't use a priviledged listen port, it should just work.

FYI
I solved it by running varnishd as user="varnish" and listen
on port 8080 and added a iptables NAT rule that redirect
port 80 to port 8080. Works fine. (Debian)

--
Benny Kjellgren

In message <4524B3EE.3060505 at linpro.no>, Ingvar Hagelund writes:
>* Benny Kjellgren
>>> I have started to test Varnish on Debian (and Archlinux) and the
>>> first thing I was looking for is to how to run Varnish as a none
>>> root user (eg www-data) and/or put it in a jail (chroot).
>>>
>>> Is it possible to do that ?
>
>* Poul-Henning Kamp
>> If you don't use a priviledged listen port, it should just work.
>
>Any plans to use the model used by eg apache or squid, with a
>dispatching process running in priviledged mode, and process children
>running with a non privilegded user?

We could do that, having the management process run as root and
he child as some other user.

--
Poul-Henning Kamp | UNIX since Zilog Zeus 3.20
phk at FreeBSD.ORG | TCP/IP since RFC 956
FreeBSD committer | BSD since 4.3-tahoe
Never attribute to malice what can adequately be explained by incompetence.

If you feel it makes sense Poul-Henning, I certainly do.

Anders Berg

> -----Opprinnelig melding-----
> Fra: varnish-misc-bounces at projects.linpro.no
> [mailto:varnish-misc-bounces at projects.linpro.no] P? vegne av
> Poul-Henning Kamp
> Sendt: 5. oktober 2006 11:38
> Til: varnish-misc at projects.linpro.no
> Emne: Re: chroot or/and none root user
>
> In message <4524B3EE.3060505 at linpro.no>, Ingvar Hagelund writes:
> >* Benny Kjellgren
> >>> I have started to test Varnish on Debian (and Archlinux) and the
> >>> first thing I was looking for is to how to run Varnish as a none
> >>> root user (eg www-data) and/or put it in a jail (chroot).
> >>>
> >>> Is it possible to do that ?
> >
> >* Poul-Henning Kamp
> >> If you don't use a priviledged listen port, it should just work.
> >
> >Any plans to use the model used by eg apache or squid, with a
> >dispatching process running in priviledged mode, and process
> children
> >running with a non privilegded user?
>
> We could do that, having the management process run as root
> and he child as some other user.
>
> --
> Poul-Henning Kamp | UNIX since Zilog Zeus 3.20
> phk at FreeBSD.ORG | TCP/IP since RFC 956
> FreeBSD committer | BSD since 4.3-tahoe
> Never attribute to malice what can adequately be explained by
> incompetence.
> _______________________________________________
> varnish-misc mailing list
> varnish-misc at projects.linpro.no
> http://projects.linpro.no/mailman/listinfo/varnish-misc
>

*****************************************************************
Denne fotnoten bekrefter at denne e-postmeldingen ble
skannet av MailSweeper og funnet fri for virus.
*****************************************************************
This footnote confirms that this email message has been swept by
MailSweeper for the presence of computer viruses.
*****************************************************************