Apache vs LiteSpeed permissions
After converting some sites from Apache 1.3 to LiteSpeed 2.2.2, the one hitch I noticed was that the access and error logs created by LiteSpeed were owned by the web server whereas Apache creates file descriptors before changing user. Isn't the web server supposed to own as little as possible? This element of LiteSpeed also extends to owning the configuration files and DEFAULT directory. If LiteSpeed logged as root, however, it could seamlessly replace the standard Apache setup without, potentially dangerously, changing ownership of certain files.
Perhaps it would be better if there was an option to perform logging as a different user or through the parent lshttpd.
|
Threaded Mode