Bug 52612 - Default Service Account
Default Service Account
Status: NEW
Product: Apache httpd-2
Classification: Unclassified
Component: Win32 MSI Installer
2.2.22
PC Windows Server 2003
: P2 normal (vote)
: ---
Assigned To: Apache HTTPD Bugs Mailing List
:
Depends on:
Blocks:
  Show dependency tree
 
Reported: 2012-02-06 21:58 UTC by chris
Modified: 2012-02-06 22:00 UTC (History)
1 user (show)



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description chris 2012-02-06 21:58:38 UTC
When installing Apache as a service, the installer currently configures the service to run under the LocalSystem account. This account has extensive privileges on the local system and acts as the computer on the network.

Would it not make more sense to run the Apache service under the LocalService account? This account has the same level of access to resources and objects as members of the Users group. This limited access helps safeguard the system if individual services or processes are compromised. Services that run as the Local Service account access network resources as a null session without credentials.

Installing under the LocalService account and setting file and folder permissions to read/execute at the top of the Apache folder tree, with read/write/execute at the log folder seems to work fine.

Info:

http://social.msdn.microsoft.com/Forums/en/sqlsecurity/thread/31d57870-1faa-4e14-8527-ce77b1ff40e4

Cheers,

Chris