Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When I run the ps -efH command to list out all the process, I can see Apache running as root and seems to have sub-processes running as www-data. Here's the excerpt:

root     30117     1  0 09:10 ?        00:00:00   /usr/sbin/apache2 -k start
www-data 30119 30117  0 09:10 ?        00:00:00     /usr/sbin/apache2 -k start
www-data 30120 30117  0 09:10 ?        00:00:00     /usr/sbin/apache2 -k start
www-data 30121 30117  0 09:10 ?        00:00:00     /usr/sbin/apache2 -k start

Can I make Apache and all sub-processes run as different user apache2d:apache2d? If so how? I read somewhere that the settings for this can be found in /etc/apache2/httpd.conf but that file seems to be empty? Can this be accomplished by changing the owner and group of the /etc/init.d/apache2 script and then settings the setuid flag on it?

share|improve this question

3 Answers 3

up vote 10 down vote accepted

Apache has to run as root initially in order to bind to port 80. If you don't run it as root initially then you cannot bind to port 80. If you want to bind to some port above 1024 then yes, you can. Otherwise don't worry about root. That is the parent Apache process and does not serve any requests. It will spawn child processes and drop privileges for handling requests.

To change the Apache user set the User and Group parameters in your Apache config.

share|improve this answer
    
Well, sorry to digress, but I notice that haproxy can run as haproxy(not as root), and bind tcp 80 port. How does this achieve? Any enlightenment? –  kiiwii Jul 4 at 4:30
    
It doesn't. Processes can only bind to ports under 1024 if it has super user privilege. So haproxy is either starting as root and dropping privileges (probably) or setuid root (unlikely). –  bahamat Jul 7 at 5:30
    
Thanks! setuid() does that. –  kiiwii Jul 8 at 1:18

@bahamat explains it pretty well, but I'll add a little more detail.

In the course of normal operation, the root-owned apache process will not perform any actual operations other than listening on port 80 and forwarding incoming connections to its (safely non-privileged, as the www-data user) children.

The location of the master configuration file depends on compile-time options and varies per distribution, but /etc/apache2/apache2.conf is a good starting guess.

Also, if you're setting up a multi-user webhosting system, you might want to look into SuExec and fcgid so that each individual webhosting user's apache process runs as said user -- so that if one user is negligent with their security, other users won't be affected.

share|improve this answer

Also, check out Apache2 ITK MPM.

It forks an Apache thread with the assigned uid/gid, this let's you keep using mod_php. No more chmod/chown etc.

share|improve this answer
    
Upvoting for mpm_itk which is a significant improvement over suexec/fcgid –  Shadur Jan 16 at 10:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.