We’ve just set up a new CloudLinux 8 server. It’s currently being prepared and doesn’t have any user accounts yet. However, the daily cron security check is reporting the following warning:
"Your CloudLinux Server has issues: Check fs.symlinkown_gid: FAILED: Web-server user 'nobody' is not in protected group specified in /proc/sys/fs/symlinkown_gid."
This message means the Apache (web server) user 'nobody' isn’t part of the group ID specified for symlink protection in the kernel setting /proc/sys/fs/symlinkown_gid. To ensure symlink protection is active and your web server is secure, this needs to be corrected.
What This Means
On our older CloudLinux 6 machines, the default group ID was 99, and fs.symlinkown_gid was set accordingly:
fs.symlinkown_gid = 99
But on CloudLinux 8, it seems the nobody user now runs under the group ID 65534. You can confirm this by running:
id nobody
Look for the gid=65534(nobody) output.
How to Fix
To update the symlink protection setting:
-
Open the sysctl configuration file:
nano /etc/sysctl.conf -
Update or add the following line:
fs.symlinkown_gid = 65534 -
Apply the changes:
sysctl -p
This tells the kernel to use the correct group ID for symlink protection based on the current configuration of the nobody user in CloudLinux 8.
Final Notes
Make sure to double-check the group ID of the nobody user on your server before applying the change. Using the wrong GID might prevent symlink protection from functioning as expected.
