Hi Everyone,
This is my first time here, so if I'm doing this wrong please correct me so that I learn. (Be gentle.)
I have a question about running Apache httpd 2.4.x on Windows Server 2008 R2. I searched everywhere online for an answer and read the manuals, but the most info I got was that someone posed this question here 11 years ago and there was no reply. (Copied below.)
The Apache 2.4 documentation recommends creating a new user for httpd that has "Log on as a service" AND "Act as part of the operating system" rights.
My question is, why is "act as part of the operating system" needed? It is a very high risk permission.
I ran Apache without this right and it seems to work fine. What feature needs it? I don't want the server to suddenly fail on me, but I also don't understand why it is "required." Help?
---- MORE DETAIL, IF YOU WANT --------
The "Act as part of the operating system" permission is a high risk permission. Programs with this access can impersonate any user on the entire computer, thereby getting full access to any file. It is basically the Windows equivalent of root.
My concern here is that setting read/write/execute permissions for the Apache user is effectively meaningless because of that capability. And more importantly, should the server get compromised for any reason (e.g., a client somehow convincing the httpd service to execute harmful code due to a configuration mistake), the attacker would be able to do literally anything if they impersonate as an Administrator.
On Linux, Apache runs a service to bind to port 80 (or whichever) as root, but the web-serving sub-processes run as limited users, so this isn't an issue there. On IIS, the sites run as site specific users ("application pool" users), so even if the server/site is compromised, the attacker has no permissions to do anything beyond affect the specific site files.
On Apache for Windows, it seems that the whole thing is run under the equivalent of root. I'm nervous do that. In fact, Microsoft specifically recommends AGAINST providing "Act as part of the operating system" to any users.
------- EMAIL I FOUND IN THE ARCHIVES THAT WAS NEVER ANSWERED ----
