Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

By default apache runs under user nobody. Is there a reason I would want to change that? Does it make things more secure?

share|improve this question
add comment

2 Answers

up vote 8 down vote accepted

No, there's really no reason to change that. Yes, it's for security. The idea is that you want to isolate the Apache processes as much as possible, so if the account running those processes were compromised, the attacker won't be able to easily do any damage to the server itself. For those reasons, nobody is almost always an unprivileged user: aside from running the processes, it doesn't own any files, can't write to any files, or really have the power to do anything at all.

share|improve this answer
add comment

You would only give it its own user if you wanted Apache to be able to access files other user(s) cannot. For example, if you want the code behind your cgi or whatever to be a secret, you might make those files only owner readable and owned by the apache user. In this case, you would still want to make sure nobody can log in to your server with that username so you should take the necessary steps for that based on your operating system.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.