For Apache as a service on Windows: is granting a domain user used for running Apache as a service and granting them the privilege of Act as part of the operating system a security concern? The Apache website recommends this. If it is a security issue, what should I be doing instead?
I am setting up Apache 2.4 64-bit on Windows Server 2008.
So far I have downloaded an archive of Apache from the apachehaus website and extracted it to my desired directory and then set up Apache as a service by running
httpd.exe -k install as per the instructions on the Apache website.
Now I can see the Apache service from services.msc
Following on from the instructions on setting up Apache as a service from the Apache website it states the following:
By default, all Apache services are registered to run as the system user (the LocalSystem account). The LocalSystem account has no privileges to your network via any Windows-secured mechanism, including the file system, named pipes, DCOM, or secure RPC. It has, however, wide privileges locally.
Then it states, as a warning:
Never grant any network privileges to the LocalSystem account! If you need Apache to be able to access network resources, create a separate account for Apache as noted below.
It then states that you should perform the following steps:
It is recommended that users create a separate account for running Apache service(s). If you have to access network resources via Apache, this is required.
- Create a normal domain user account, and be sure to memorize its password.
- Grant the newly-created user a privilege of Log on as a service and Act as part of the operating system. On Windows NT 4.0 these privileges are granted via User Manager for Domains, but on Windows 2000 and XP you probably want to use Group Policy for propagating these settings. You can also manually set these via the Local Security Policy MMC snap-in.
- Confirm that the created account is a member of the Users group.
- Grant the account read and execute (RX) rights to all document and script folders (htdocs and cgi-bin for example).
- Grant the account change (RWXD) rights to the Apache logs directory.
- Grant the account read and execute (RX) rights to the httpd.exe binary executable.
and it goes on ... after googling up on some of the aforementioned steps I came across some forum posts that raised some security concerns regarding step 2:
2. Grant the newly-created user a privilege of Log on as a service and Act as part of the operating system.
So, could anyone confirm if granting a domain user utilised for running Apache as a service and granting them the privilege of Act as part of the operating system is a security concern? Is it required? Is there a better approach to take here?
The aforementioned security concerns I found on the forums linked to the following Microsoft website https://msdn.microsoft.com/en-us/subscriptions/dn221957 which states:
The Act as part of the operating system policy setting determines whether a process can assume the identity of any user and thereby gain access to the resources that the user is authorised to access.