c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<?xml version="1.0"?>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<!DOCTYPE modulesynopsis SYSTEM "/style/modulesynopsis.dtd">

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<?xml-stylesheet type="text/xsl" href="/style/manual.en.xsl"?>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw

c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<modulesynopsis metafile="mod_unixd.xml.meta">

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<name>mod_unixd</name>

c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai<description>Basic (required) security for Unix-family platforms.</description>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<status>Base</status>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<directivesynopsis>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<name>Group</name>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<description>Group under which the server will answer

c5c4113dfcabb1eed3d4bdf7609de5170027a794nwrequests</description>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<syntax>Group <var>unix-group</var></syntax>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<default>Group #-1</default>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<contextlist><context>server config</context></contextlist>

7014882c6a3672fd0e5d60200af8643ae53c5928Richard Lowe<compatibility>Only valid in global server config since Apache

7014882c6a3672fd0e5d60200af8643ae53c5928Richard Lowe2.0</compatibility>

7014882c6a3672fd0e5d60200af8643ae53c5928Richard Lowe

7014882c6a3672fd0e5d60200af8643ae53c5928Richard Lowe<usage>

7014882c6a3672fd0e5d60200af8643ae53c5928Richard Lowe <p>The <directive>Group</directive> directive sets the group under

7014882c6a3672fd0e5d60200af8643ae53c5928Richard Lowe which the server will answer requests. In order to use this

7014882c6a3672fd0e5d60200af8643ae53c5928Richard Lowe directive, the server must be run initially as <code>root</code>. If

7014882c6a3672fd0e5d60200af8643ae53c5928Richard Lowe you start the server as a non-root user, it will fail to change to the

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw specified group, and will instead continue to run as the group of the

c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai original user. <var>Unix-group</var> is one of:</p>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw <dl>

c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai <dt>A group name</dt>

c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai <dd>Refers to the given group by name.</dd>

c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai

c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai <dt><code>#</code> followed by a group number.</dt>

c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai <dd>Refers to a group by its number.</dd>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw </dl>

c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw <example><title>Example</title>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw Group www-group

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw </example>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw <p>It is recommended that you set up a new group specifically for

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw running the server. Some admins use user <code>nobody</code>,

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw but this is not always possible or desirable.</p>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw <note type="warning"><title>Security</title>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw <p>Don't set <directive>Group</directive> (or <directive

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw module="mod_unixd">User</directive>) to <code>root</code> unless

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw you know exactly what you are doing, and what the dangers are.</p>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw </note>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw</usage>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<seealso><directive module="mod_privileges">VHostGroup</directive></seealso>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<seealso><directive module="mod_suexec">SuexecUserGroup</directive></seealso>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw</directivesynopsis>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<directivesynopsis>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<name>User</name>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<description>The userid under which the server will answer

c5c4113dfcabb1eed3d4bdf7609de5170027a794nwrequests</description>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<syntax>User <var>unix-userid</var></syntax>

7a8a68f5e3efbaec1a375c2d50bd20b566631755Julian Pullen<default>User #-1</default>

7a8a68f5e3efbaec1a375c2d50bd20b566631755Julian Pullen<contextlist><context>server config</context></contextlist>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw<compatibility>Only valid in global server config since Apache

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw2.0</compatibility>

c5c4113dfcabb1eed3d4bdf7609de5170027a794nw

<usage>

<p>The <directive>User</directive> directive sets the user ID as

which the server will answer requests. In order to use this

directive, the server must be run initially as <code>root</code>.

If you start the server as a non-root user, it will fail to change

to the lesser privileged user, and will instead continue to run as

that original user. If you do start the server as <code>root</code>,

then it is normal for the parent process to remain running as root.

<var>Unix-userid</var> is one of:</p>

<dl>

<dt>A username</dt>

<dd>Refers to the given user by name.</dd>

<dt># followed by a user number.</dt>

<dd>Refers to a user by its number.</dd>

</dl>

<p>The user should have no privileges that result in it being

able to access files that are not intended to be visible to the

outside world, and similarly, the user should not be able to

execute code that is not meant for HTTP requests. It is

recommended that you set up a new user and group specifically for

running the server. Some admins use user <code>nobody</code>, but

this is not always desirable, since the <code>nobody</code> user

can have other uses on the system.</p>

<note type="warning"><title>Security</title>

<p>Don't set <directive>User</directive> (or <directive

module="mod_unixd">Group</directive>) to <code>root</code> unless

you know exactly what you are doing, and what the dangers are.</p>

</note>

</usage>

<seealso><directive module="mod_privileges">VHostUser</directive></seealso>

<seealso><directive module="mod_suexec">SuexecUserGroup</directive></seealso>

</directivesynopsis>

<directivesynopsis>

<name>ChrootDir</name>

<description>Directory for apache to run chroot(8) after startup.</description>

<syntax>ChrootDir <var>/path/to/directory</var></syntax>

<default>none</default>

<contextlist><context>server config</context></contextlist>

<modulelist><module>mod_unixd</module></modulelist>

<usage>

<p>This directive, available in httpd 2.2.9(?) and later, tells the

server to <var>chroot(8)</var> to the specified directory after

startup, but before accepting requests over the 'net.</p>

<p>Note that running the server under chroot is not simple,

and requires additional setup, particularly if you are running

scripts such as CGI or PHP. Please make sure you are properly

familiar with the operation of chroot before attempting to use

this feature.</p>

</usage>

</directivesynopsis>

</modulesynopsis>