The first line of the documentation for User and Group says they only apply
to standalone mode. In addition, httpd.conf-dist says ``If you are running
from inetd, go to ServerAdmin'' which skips over User and Group.
* You could now argue to use the "user" entry in the inetd.conf file,
* BUT:
* - I can't set the gid there
* - some older systems don't support this (yet)
*
* Rob, could you please add the code from the standalon section to
* the inetd section?!
I'll consider it. You should consider running standalone.
* This all doesn't solve a more serious problem with the <INC>
* instruction!
* Having user-directories configured, any user is able to execute ANY
* command out of this document, and this command is run under
* server privileges.
* This should IMHO be changed to only allow starting of programs
* out of .../cgi-bin/ for example.
*/
PLEASE READ THE DOCUMENTATION.
The Options directive in access.conf can be used to stop this. If you've
done your homework and you know that Directory applies to physical
directories instead of logical directories, you can use:
<Directory />
AllowOverride None
Options Indexes FollowSymLinks
</Directory>
Similarly, if all of your users' directories come out of one or two
directories (like /user1 or /home), you can change the / in Directory / to
that directory.
--Rob