Linux – Running Apache as a different user

apache-http-serverlinuxpermissionsUbuntuuser-accounts

When I run the ps -efH command to list out all the process, I can see Apache running as root and seems to have sub-processes running as www-data. Here's the excerpt:

root     30117     1  0 09:10 ?        00:00:00   /usr/sbin/apache2 -k start
www-data 30119 30117  0 09:10 ?        00:00:00     /usr/sbin/apache2 -k start
www-data 30120 30117  0 09:10 ?        00:00:00     /usr/sbin/apache2 -k start
www-data 30121 30117  0 09:10 ?        00:00:00     /usr/sbin/apache2 -k start

Can I make Apache and all sub-processes run as different user apache2d:apache2d? If so how? I read somewhere that the settings for this can be found in /etc/apache2/httpd.conf but that file seems to be empty? Can this be accomplished by changing the owner and group of the /etc/init.d/apache2 script and then settings the setuid flag on it?

Best Answer

Apache has to run as root initially in order to bind to port 80. If you don't run it as root initially then you cannot bind to port 80. If you want to bind to some port above 1024 then yes, you can. Otherwise don't worry about root. That is the parent Apache process and does not serve any requests. It will spawn child processes and drop privileges for handling requests.

To change the Apache user set the User and Group parameters in your Apache config.

Related Question