4

TL;DR

For Apache as a service on Windows: is granting a domain user used for running Apache as a service and granting them the privilege of Act as part of the operating system a security concern? The Apache website recommends this. If it is a security issue, what should I be doing instead?


I am setting up Apache 2.4 64-bit on Windows Server 2008.

So far I have downloaded an archive of Apache from the apachehaus website and extracted it to my desired directory and then set up Apache as a service by running httpd.exe -k install as per the instructions on the Apache website.

Now I can see the Apache service from services.msc

Apache service from services.msc

Following on from the instructions on setting up Apache as a service from the Apache website it states the following:

By default, all Apache services are registered to run as the system user (the LocalSystem account). The LocalSystem account has no privileges to your network via any Windows-secured mechanism, including the file system, named pipes, DCOM, or secure RPC. It has, however, wide privileges locally.

Then it states, as a warning:

Never grant any network privileges to the LocalSystem account! If you need Apache to be able to access network resources, create a separate account for Apache as noted below.

It then states that you should perform the following steps:

It is recommended that users create a separate account for running Apache service(s). If you have to access network resources via Apache, this is required.

  1. Create a normal domain user account, and be sure to memorize its password.
  2. Grant the newly-created user a privilege of Log on as a service and Act as part of the operating system. On Windows NT 4.0 these privileges are granted via User Manager for Domains, but on Windows 2000 and XP you probably want to use Group Policy for propagating these settings. You can also manually set these via the Local Security Policy MMC snap-in.
  3. Confirm that the created account is a member of the Users group.
  4. Grant the account read and execute (RX) rights to all document and script folders (htdocs and cgi-bin for example).
  5. Grant the account change (RWXD) rights to the Apache logs directory.
  6. Grant the account read and execute (RX) rights to the httpd.exe binary executable.

and it goes on ... after googling up on some of the aforementioned steps I came across some forum posts that raised some security concerns regarding step 2:

2. Grant the newly-created user a privilege of Log on as a service and Act as part of the operating system.

So, could anyone confirm if granting a domain user utilised for running Apache as a service and granting them the privilege of Act as part of the operating system is a security concern? Is it required? Is there a better approach to take here?

The aforementioned security concerns I found on the forums linked to the following Microsoft website https://msdn.microsoft.com/en-us/subscriptions/dn221957 which states:

The Act as part of the operating system policy setting determines whether a process can assume the identity of any user and thereby gain access to the resources that the user is authorised to access.

3
  • Why do you want to use a domain user? I also see no need for the “Act as part of the operating system” privilege. I’d create a dedicated (local, if possible) user account for the service. – Daniel B Dec 1 '16 at 10:20
  • @DanielB Thanks for your comment. My question is simply explaining the instructions from the Apache website. I didn't decide I wanted to use a domain user, the apache website states Create a normal domain user account see the link: httpd.apache.org/docs/current/platform/windows.html#winsvc. Re: creating a dedicated local user - I'm guessing a local user account would not be the same as the LocalSystem account? Apologies for my ignorance here, this isn't really my area of expertise! – haakym Dec 1 '16 at 10:25
  • There is a separate "local user and groups" dialog (lusrmgr.msc) available in windows which would list things like the local Administrator group and the local Administrator account. – Seth Dec 1 '16 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.