mpm_common.html revision d2d8aa3fe823a465c7dbc57757a82b4e89114cb8
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering<HTML>
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering<HEAD>
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering<TITLE>Apache MPM Common Directives</TITLE>
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering</HEAD>
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering<!-- Background white, links blue (unvisited), navy (visited), red (active) -->
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering<BODY
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering BGCOLOR="#FFFFFF"
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering TEXT="#000000"
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering LINK="#0000FF"
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering VLINK="#000080"
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering ALINK="#FF0000"
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering>
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering<!--#include virtual="header.html" -->
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering<H1 ALIGN="CENTER">Multi-Processing Module Common Directives</H1>
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering<P>This file documents directives that are implemented by more
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poetteringthan one multi-processing module (MPM).
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering</P>
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering<H2>Directives</H2>
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering<UL>
edce2aed3aa93b84f7b4c70412bdb665da2977b0Lennart Poettering<li><a href="#coredumpdirectory">CoreDumpDirectory</a></li>
<li><a href="#group">Group</a></li>
<li><a href="#pidfile">PidFile</a></li>
<li><a href="#listen">Listen</a></li>
<li><a href="#listenbacklog">ListenBacklog</a></li>
<li><a href="#lockfile">LockFile</a></li>
<li><a href="#maxclients">MaxClients</a></li>
<li><a href="#maxrequestsperchild">MaxRequestsPerChild</a></li>
<li><a href="#maxsparethreads">MaxSpareThreads</a></li>
<li><a href="#minsparethreads">MinSpareThreads</a></li>
<li><a href="#scoreboardfile">ScoreBoardFile</a></li>
<li><a href="#sendbuffersize">SendBufferSize</a></li>
<li><a href="#startservers">StartServers</a></li>
<li><a href="#threadsperchild">ThreadsPerChild</a></li>
<li><a href="#user">User</a></li>
</UL>
<HR>
<H2><A NAME="coredumpdirectory">CoreDumpDirectory directive</A></H2>
<!--%plaintext &lt;?INDEX {\tt CoreDumpDirectory} directive&gt; -->
<p><A
HREF="directive-dict.html#Syntax"
REL="Help"
><STRONG>Syntax:</STRONG></A> CoreDumpDirectory <EM>directory</EM><BR>
<A
HREF="directive-dict.html#Default"
REL="Help"
><STRONG>Default:</STRONG></A> the same location as ServerRoot<BR>
<A
HREF="directive-dict.html#Context"
REL="Help"
><STRONG>Context:</STRONG></A> server config<BR>
<A
HREF="directive-dict.html#Status"
REL="Help"
><STRONG>Status:</STRONG></A> MPM<BR>
<A
HREF="directive-dict.html#Module"
REL="Help"
><STRONG>Module:</STRONG></A> dexter, mpmt_pthread, prefork, mpm_winnt</p>
<p>This controls the directory to which Apache attempts to switch
before dumping core. The default is in the <A
HREF="core.html#serverroot">ServerRoot</A> directory, however since
this should not be writable by the user the server runs as, core dumps
won't normally get written. If you want a core dump for debugging,
you can use this directive to place it in a different location.<P><HR>
<H2><A NAME="group">Group directive</A></H2>
<!--%plaintext &lt;?INDEX {\tt Group} directive&gt; -->
<A
HREF="directive-dict.html#Syntax"
REL="Help"
><STRONG>Syntax:</STRONG></A> Group <EM>unix-group</EM><BR>
<A
HREF="directive-dict.html#Default"
REL="Help"
><STRONG>Default:</STRONG></A> <CODE>Group #-1</CODE><BR>
<A
HREF="directive-dict.html#Context"
REL="Help"
><STRONG>Context:</STRONG></A> server config, virtual host<BR>
<A
HREF="directive-dict.html#Status"
REL="Help"
><STRONG>Status:</STRONG></A> MPM<BR>
<A
HREF="directive-dict.html#Module"
REL="Help"
><STRONG>Module:</STRONG></A> dexter, mpmt_pthread, prefork</p>
The Group directive sets the group under which the server will answer requests.
In order to use this directive, the stand-alone server must be run initially
as root. <EM>Unix-group</EM> is one of:
<DL>
<DT>A group name
<DD>Refers to the given group by name.
<DT># followed by a group number.
<DD>Refers to a group by its number.
</DL>
It is recommended that you set up a new group specifically for running the
server. Some admins use user <CODE>nobody</CODE>, but this is not always
possible or desirable.<P>
Note: if you start the server as a non-root user, it will fail to change
to the specified group, and will instead continue to run as the group of the
original user. <P>
Special note: Use of this directive in &lt;VirtualHost&gt; requires a
properly configured <A HREF="/suexec.html">suEXEC wrapper</A>.
When used inside a &lt;VirtualHost&gt; in this manner, only the group
that CGIs are run as is affected. Non-CGI requests are still processed
as the group specified in the main Group directive.<P>
SECURITY: See <A HREF="#user">User</A> for a discussion of the security
considerations.<P><HR>
<H2><A NAME="pidfile">PidFile directive</A></H2>
<!--%plaintext &lt;?INDEX {\tt PidFile} directive&gt; -->
<p><A
HREF="directive-dict.html#Syntax"
REL="Help"
><STRONG>Syntax:</STRONG></A> PidFile <EM>filename</EM><BR>
<A
HREF="directive-dict.html#Default"
REL="Help"
><STRONG>Default:</STRONG></A> <CODE>PidFile logs/httpd.pid</CODE><BR>
<A
HREF="directive-dict.html#Context"
REL="Help"
><STRONG>Context:</STRONG></A> server config<BR>
<A
HREF="directive-dict.html#Status"
REL="Help"
><STRONG>Status:</STRONG></A> MPM<BR>
<A
HREF="directive-dict.html#Module"
REL="Help"
><STRONG>Module:</STRONG></A> dexter, mpmt_pthread, prefork, mpm_winnt</p>
<p>The PidFile directive sets the file to which the server records the
process id of the daemon. If the filename does not begin with a slash
(/) then it is assumed to be relative to the <A
HREF="core.html#serverroot">ServerRoot</A>.</p>
<p>It is often useful to be able to send the server a signal, so that
it closes and then reopens its <A
HREF="core.html#errorlog">ErrorLog</A> and TransferLog, and re-reads
its configuration files. This is done by sending a SIGHUP (kill -1)
signal to the process id listed in the PidFile.</p>
<p>The PidFile is subject to the same warnings about log file placement and
<A HREF="/misc/security_tips.html#serverroot">security</A>.</p>
<p><hr>
<H2><A NAME="listen">Listen directive</A></H2>
<p><A
HREF="directive-dict.html#Syntax"
REL="Help"
><STRONG>Syntax:</STRONG></A>
Listen [<EM>IP address</EM>:]<EM>port number</EM><BR>
<A
HREF="directive-dict.html#Context"
REL="Help"
><STRONG>Context:</STRONG></A> server config<BR>
<A
HREF="directive-dict.html#Status"
REL="Help"
><STRONG>Status:</STRONG></A> MPM<BR>
<A
HREF="directive-dict.html#Module"
REL="Help"
><STRONG>Module:</STRONG></A> dexter, mpmt_pthread, prefork, mpm_winnt</p>
<P>The Listen directive instructs Apache to listen to more than one IP
address or port; by default it responds to requests on all IP
interfaces, but only on the port given by the <CODE><A
HREF="#port">Port</A></CODE> directive.</P>
<TT>Listen</TT> can be used instead of <TT><A
HREF="#bindaddress">BindAddress</A></TT> and <TT>Port</TT>. It tells
the server to accept incoming requests on the specified port or
address-and-port combination. If the first format is used, with a port
number only, the server listens to the given port on all interfaces,
instead of the port given by the <TT>Port</TT> directive. If an IP
address is given as well as a port, the server will listen on the
given port and interface. <P>
Note that you may still require a <TT>Port</TT> directive so
that URLs that Apache generates that point to your server still
work.<P>
Multiple Listen directives may be used
to specify a number of addresses and ports to listen to. The server
will respond to requests from any of the listed addresses and
ports.
<P>
For example, to make the server accept connections on both port
80 and port 8000, use:
<PRE>
Listen 80
Listen 8000
</PRE>
To make the server accept connections on two specified
interfaces and port numbers, use
<PRE>
Listen 192.170.2.1:80
Listen 192.170.2.5:8000
</PRE>
<P><STRONG>See Also:</STRONG>
<A HREF="/dns-caveats.html">DNS Issues</A><BR>
<STRONG>See Also:</STRONG>
<A HREF="/bind.html">Setting which addresses and ports Apache uses</A><BR>
<STRONG>See Also:</STRONG>
<A HREF="http://www.apache.org/info/known_bugs.html#listenbug">Known Bugs</A>
</P>
<HR>
<H2><A NAME="listenbacklog">ListenBacklog directive</A></H2>
<p><A
HREF="directive-dict.html#Syntax"
REL="Help"
><STRONG>Syntax:</STRONG></A> ListenBacklog <EM>backlog</EM><BR>
<A
HREF="directive-dict.html#Default"
REL="Help"
><STRONG>Default:</STRONG></A> <CODE>ListenBacklog 511</CODE><BR>
<A
HREF="directive-dict.html#Context"
REL="Help"
><STRONG>Context:</STRONG></A> server config<BR>
<A
HREF="directive-dict.html#Status"
REL="Help"
><STRONG>Status:</STRONG></A> MPM<BR>
<A
HREF="directive-dict.html#Module"
REL="Help"
><STRONG>Module:</STRONG></A> dexter, mpmt_pthread, prefork, mpm_winnt</p>
<P>The maximum length of the queue of pending connections. Generally no
tuning is needed or desired, however on some systems it is desirable
to increase this when under a TCP SYN flood attack. See
the backlog parameter to the <CODE>listen(2)</CODE> system call.
<P>This will often be limited to a smaller number by the operating
system. This varies from OS to OS. Also note that many OSes do not
use exactly what is specified as the backlog, but use a number based on
(but normally larger than) what is set.
<HR>
<H2><A NAME="lockfile">LockFile directive</A></H2>
<p><A
HREF="directive-dict.html#Syntax"
REL="Help"
><STRONG>Syntax:</STRONG></A> LockFile <EM>filename</EM><BR>
<A
HREF="directive-dict.html#Default"
REL="Help"
><STRONG>Default:</STRONG></A> <CODE>LockFile logs/accept.lock</CODE><BR>
<A
HREF="directive-dict.html#Context"
REL="Help"
><STRONG>Context:</STRONG></A> server config<BR>
<A
HREF="directive-dict.html#Status"
REL="Help"
><STRONG>Status:</STRONG></A> MPM<BR>
<A
HREF="directive-dict.html#Module"
REL="Help"
><STRONG>Module:</STRONG></A> dexter, mpmt_pthread, prefork</p>
<p>The LockFile directive sets the path to the lockfile used when
Apache is compiled with either USE_FCNTL_SERIALIZED_ACCEPT or
USE_FLOCK_SERIALIZED_ACCEPT. This directive should normally be
left at its default value. The main reason for changing it is if
the <CODE>logs</CODE> directory is NFS mounted, since <STRONG>the lockfile
must be stored on a local disk</STRONG>. The PID of the main
server process is automatically appended to the filename. <P>
<p><STRONG>SECURITY:</STRONG> It is best to avoid putting this file in a
world writable directory such as <CODE>/var/tmp</CODE> because someone
could create a denial of service attack and prevent the server from
starting by creating a lockfile with the same name as the one the
server will try to create.</p>
<hr>
<H2><A NAME="maxclients">MaxClients directive</A></H2>
<!--%plaintext &lt;?INDEX {\tt MaxClients} directive&gt; -->
<p><A
HREF="directive-dict.html#Syntax"
REL="Help"
><STRONG>Syntax:</STRONG></A> MaxClients <EM>number</EM><BR>
<A
HREF="directive-dict.html#Default"
REL="Help"
><STRONG>Default:</STRONG></A> <CODE>MaxClients 8</code> (with threads)
<code>MaxClients 256</code> (no threads)<BR>
<A
HREF="directive-dict.html#Context"
REL="Help"
><STRONG>Context:</STRONG></A> server config<BR>
<A
HREF="directive-dict.html#Status"
REL="Help"
><STRONG>Status:</STRONG></A> MPM<BR>
<A
HREF="directive-dict.html#Module"
REL="Help"
><STRONG>Module:</STRONG></A> mpmt_pthread, prefork</p>
<P>The MaxClients directive sets the limit on the number of child
processes that will be created to serve requests. When the server is
built without threading, no more than this number of clients can be
served simultaneously. To configure more than 256 clients, you must
edit the <code>HARD_SERVER_LIMIT</code> entry in
<code>mpm_default.h</code> and recompile.
<P>Any connection attempts over the MaxClients limit will normally
be queued, up to a number based on the <A HREF="#listenbacklog">
ListenBacklog</A> directive. Once a child process is freed at the
end of a different request, the connection will then be serviced.</p>
<p>When the server is compiled with threading, then the maximum number
of simultaneous requests that can be served is obtained from the value
of this directive multiplied by <a
href="#threadsperchild">ThreadsPerChild</a>.</p>
<HR>
<H2><A NAME="maxrequestsperchild">MaxRequestsPerChild directive</A></H2>
<!--%plaintext &lt;?INDEX {\tt MaxRequestsPerChild} directive&gt; -->
<p><A
HREF="directive-dict.html#Syntax"
REL="Help"
><STRONG>Syntax:</STRONG></A> MaxRequestsPerChild <EM>number</EM><BR>
<A
HREF="directive-dict.html#Default"
REL="Help"
><STRONG>Default:</STRONG></A> <CODE>MaxRequestsPerChild 10000</CODE><BR>
<A
HREF="directive-dict.html#Context"
REL="Help"
><STRONG>Context:</STRONG></A> server config<BR>
<A
HREF="directive-dict.html#Status"
REL="Help"
><STRONG>Status:</STRONG></A> MPM<BR>
<A
HREF="directive-dict.html#Module"
REL="Help"
><STRONG>Module:</STRONG></A> dexter, mpmt_pthread, prefork, mpm_winnt</p>
<p>The MaxRequestsPerChild directive sets the limit on the number of requests
that an individual child server process will handle. After MaxRequestsPerChild
requests, the child process will die. If MaxRequestsPerChild is 0, then
the process will never expire.<P>
Setting MaxRequestsPerChild to a non-zero limit has two beneficial effects:
<UL>
<LI>it limits the amount of memory that process can consume by (accidental)
memory leakage;
<LI> by giving processes a finite lifetime, it helps reduce the
number of processes when the server load reduces.
</UL>
<P><STRONG>NOTE:</STRONG> For <EM>KeepAlive</EM> requests, only the first
request is counted towards this limit. In effect, it changes the
behavior to limit the number of <EM>connections</EM> per child.
<P><HR>
<H2><A NAME="maxsparethreads">MaxSpareThreads directive</A></H2>
<!--%plaintext &lt;?INDEX {\tt MaxSpareServers} directive&gt; -->
<p><A
HREF="directive-dict.html#Syntax"
REL="Help"
><STRONG>Syntax:</STRONG></A> MaxSpareThreads <EM>number</EM><BR>
<A
HREF="directive-dict.html#Default"
REL="Help"
><STRONG>Default:</STRONG></A> <CODE>MaxSpareThreads ??</CODE><BR>
<A
HREF="directive-dict.html#Context"
REL="Help"
><STRONG>Context:</STRONG></A> server config<BR>
<A
HREF="directive-dict.html#Status"
REL="Help"
><STRONG>Status:</STRONG></A> core<BR>
<A
HREF="directive-dict.html#Module"
REL="Help"
><STRONG>Module:</STRONG></A> dexter, mpmt_pthread</p>
<P>Maximum number of idle threads.</p>
<p>See also <A HREF="#minsparethreads">MinSpareThreads</A> and
<A HREF="#startservers">StartServers</A>.
<P><HR>
<H2><A NAME="minsparethreads">MinSpareThreads directive</A></H2>
<!--%plaintext &lt;?INDEX {\tt MinSpareServers} directive&gt; -->
<p><A
HREF="directive-dict.html#Syntax"
REL="Help"
><STRONG>Syntax:</STRONG></A> MinSpareServers <EM>number</EM><BR>
<A
HREF="directive-dict.html#Default"
REL="Help"
><STRONG>Default:</STRONG></A> <CODE>MinSpareServers ???</CODE><BR>
<A
HREF="directive-dict.html#Context"
REL="Help"
><STRONG>Context:</STRONG></A> server config<BR>
<A
HREF="directive-dict.html#Status"
REL="Help"
><STRONG>Status:</STRONG></A> core<BR>
<A
HREF="directive-dict.html#Module"
REL="Help"
><STRONG>Module:</STRONG></A> dexter, mpmt_pthread</p>
<p>Minimum number of idle threads to handle request spikes.
See also <A HREF="#maxsparethreads">MaxSpareThreads</A> and
<A HREF="#startservers">StartServers</A>.<P><HR>
<H2><A NAME="scoreboardfile">ScoreBoardFile directive</A></H2>
<!--%plaintext &lt;?INDEX {\tt ScoreBoardFile} directive&gt; -->
<p><A
HREF="directive-dict.html#Syntax"
REL="Help"
><STRONG>Syntax:</STRONG></A> ScoreBoardFile <EM>filename</EM><BR>
<A
HREF="directive-dict.html#Default"
REL="Help"
><STRONG>Default:</STRONG></A> <CODE>ScoreBoardFile logs/apache_status</CODE>
<BR>
<A
HREF="directive-dict.html#Context"
REL="Help"
><STRONG>Context:</STRONG></A> server config<BR>
<A
HREF="directive-dict.html#Status"
REL="Help"
><STRONG>Status:</STRONG></A> MPM<BR>
<A
HREF="directive-dict.html#Compatibility"
REL="Help"
>
<A
HREF="directive-dict.html#Module"
REL="Help"
><STRONG>Module:</STRONG></A> dexter, mpmt_pthread, prefork</p>
<p>The ScoreBoardFile directive is required on some architectures to place
a file that the server will use to communicate between its children and
the parent. The easiest way to find out if your architecture requires
a scoreboard file is to run Apache and see if it creates the file named
by the directive. If your architecture requires it then you must ensure
that this file is not used at the same time by more than one invocation
of Apache.</p>
<p>If you have to use a ScoreBoardFile then you may see improved speed by
placing it on a RAM disk. But be careful that you heed the same warnings
about log file placement and
<A HREF="/misc/security_tips.html">security</A>.</p>
<p><STRONG>See Also</STRONG>:
<A HREF="/stopping.html">Stopping and Restarting Apache</A></P>
<P><HR>
<H2><A NAME="sendbuffersize">SendBufferSize directive</A></H2>
<!--%plaintext &lt;?INDEX {\tt SendBufferSize} directive&gt; -->
<p><A
HREF="directive-dict.html#Syntax"
REL="Help"
><STRONG>Syntax:</STRONG></A> SendBufferSize <EM>bytes</EM><BR>
<A
HREF="directive-dict.html#Context"
REL="Help"
><STRONG>Context:</STRONG></A> server config<BR>
<A
HREF="directive-dict.html#Status"
REL="Help"
><STRONG>Status:</STRONG></A> MPM<BR>
<A
HREF="directive-dict.html#Module"
REL="Help"
><STRONG>Module:</STRONG></A> dexter, mpmt_pthread, prefork, mpm_winnt</p>
The server will set the TCP buffer size to the number of bytes
specified. Very useful to increase past standard OS defaults on high
speed high latency (<EM>i.e.</EM>, 100ms or so, such as transcontinental
fast pipes)
<P><HR>
<H2><A NAME="startservers">StartServers directive</A></H2>
<!--%plaintext &lt;?INDEX {\tt StartServers} directive&gt; -->
<p><A
HREF="directive-dict.html#Syntax"
REL="Help"
><STRONG>Syntax:</STRONG></A> StartServers <EM>number</EM><BR>
<A
HREF="directive-dict.html#Default"
REL="Help"
><STRONG>Default:</STRONG></A> <CODE>StartServers 5</CODE><BR>
<A
HREF="directive-dict.html#Context"
REL="Help"
><STRONG>Context:</STRONG></A> server config<BR>
<A
HREF="directive-dict.html#Status"
REL="Help"
><STRONG>Status:</STRONG></A> MPM<BR>
<A
HREF="directive-dict.html#Module"
REL="Help"
><STRONG>Module:</STRONG></A> mpmt_pthread, prefork</p>
<p>The StartServers directive sets the number of child server processes created
on startup. As the number of processes is dynamically controlled depending
on the load, there is usually little reason to adjust this parameter.</P>
<P>See also <A HREF="#minsparethreads">MinSpareThreads</A> and
<A HREF="#maxsparethreads">MaxSpareThreads</A>.<P><HR>
<H2><A NAME="threadsperchild">ThreadsPerChild</A></H2>
<p><A
HREF="directive-dict.html#Syntax"
REL="Help"
><STRONG>Syntax:</STRONG></A> ThreadsPerChild <EM>number</EM><BR>
<A
HREF="directive-dict.html#Default"
REL="Help"
><STRONG>Default:</STRONG></A> <CODE>ThreadsPerChild 50</CODE><BR>
<A
HREF="directive-dict.html#Context"
REL="Help"
><STRONG>Context:</STRONG></A> server config<BR>
<A
HREF="directive-dict.html#Status"
REL="Help"
><STRONG>Status:</STRONG></A> MPM<BR>
<A
HREF="directive-dict.html#Module"
REL="Help"
><STRONG>Module:</STRONG></A> mpmt_pthread, mpm_winnt</p>
<P>This directive sets the number of threads created by each child
process.</p>
<p><hr>
<H2><A NAME="user">User directive</A></H2>
<!--%plaintext &lt;?INDEX {\tt User} directive&gt; -->
<p><A
HREF="directive-dict.html#Syntax"
REL="Help"
><STRONG>Syntax:</STRONG></A> User <EM>unix-userid</EM><BR>
<A
HREF="directive-dict.html#Default"
REL="Help"
><STRONG>Default:</STRONG></A> <CODE>User #-1</CODE><BR>
<A
HREF="directive-dict.html#Context"
REL="Help"
><STRONG>Context:</STRONG></A> server config, virtual host<BR>
<A
HREF="directive-dict.html#Status"
REL="Help"
><STRONG>Status:</STRONG></A> core<BR>
<A
HREF="directive-dict.html#Module"
REL="Help"
><STRONG>Module:</STRONG></A> dexter, mpmt_pthread, prefork</p>
The User directive sets the userid as which the server will answer requests.
In order to use this directive, the standalone server must be run initially
as root. <EM>Unix-userid</EM> is one of:
<DL>
<DT>A username
<DD>Refers to the given user by name.
<DT># followed by a user number.
<DD>Refers to a user by their number.
</DL>
The user should have no privileges which result in it being able to access
files which are not intended to be visible to the outside world, and
similarly, the user should not be able to execute code which is not
meant for httpd requests. It is recommended that you set up a new user and
group specifically for running the server. Some admins use user
<CODE>nobody</CODE>, but this is not always possible or desirable.
For example mod_proxy's cache, when enabled, must be accessible to this user
(see the <A HREF="mod_proxy.html#cacheroot"><CODE>CacheRoot</CODE>
directive</A>).<P>
Notes: If you start the server as a non-root user, it will fail to change
to the lesser privileged user, and will instead continue to run as
that original user. If you do start the server as root, then it is normal
for the parent process to remain running as root.<P>
Special note: Use of this directive in &lt;VirtualHost&gt; requires a
properly configured <A HREF="/suexec.html">suEXEC wrapper</A>.
When used inside a &lt;VirtualHost&gt; in this manner, only the user
that CGIs are run as is affected. Non-CGI requests are still processed
with the user specified in the main User directive.<P>
SECURITY: Don't set User (or <A HREF="#group">Group</A>) to
<CODE>root</CODE> unless you know exactly what you are doing, and what the
dangers are.<P><HR>
<!--#include virtual="footer.html" -->
</BODY>
</HTML>