Re: pkg/35142: lighttpd doesn't create an own user (like apache does)

[Joerg Sonnenberger <joerg%britannica.bec.de@localhost>]

The following reply was made to PR pkg/35142; it has been noted by GNATS.

From: Joerg Sonnenberger <joerg%britannica.bec.de@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: pkg/35142: lighttpd doesn't create an own user (like apache does)
Date: Mon, 27 Nov 2006 18:34:38 +0100

 On Mon, Nov 27, 2006 at 05:05:01PM +0000, Wouter Schoot wrote:
 > >Description:
 > lighttpd is an alternative webserver for like for instance apache. However, 
 > the
 > pkg doesn't create a user (i.e. 'www') to run under. I think this is good
 > behaviour to enforce, just as apache does. Moreover pkg's like phpmyadmin
 > blindly trust on the existance of a www user (hardcoded in the Makefile).
 
 The question is which one. I have multiple setups with lighty and run it
 both as a normal user (not via rc.d), as www:www and other users,
 depending on the circumstances. I don't think we reusing www would be a
 good idea for an default name, as it makes the protection at least
 partly go away when Apache is also running on the machine.
 
 Beside, the part about phpmyadmin does not apply, but I answer about
 that in the original PR.
 
 Joerg