2 <!DOCTYPE modulesynopsis SYSTEM "../style/modulesynopsis.dtd">
3 <?xml-stylesheet type="text/xsl" href="../style/manual.en.xsl"?>
4 <!-- $LastChangedRevision$ -->
7 Licensed to the Apache Software Foundation (ASF) under one or more
8 contributor license agreements. See the NOTICE file distributed with
9 this work for additional information regarding copyright ownership.
10 The ASF licenses this file to You under the Apache License, Version 2.0
11 (the "License"); you may not use this file except in compliance with
12 the License. You may obtain a copy of the License at
14 http://www.apache.org/licenses/LICENSE-2.0
16 Unless required by applicable law or agreed to in writing, software
17 distributed under the License is distributed on an "AS IS" BASIS,
18 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
19 See the License for the specific language governing permissions and
20 limitations under the License.
23 <modulesynopsis metafile="mod_unixd.xml.meta">
25 <name>mod_unixd</name>
26 <description>Basic (required) security for Unix-family platforms.</description>
31 <description>Group under which the server will answer
32 requests</description>
33 <syntax>Group <var>unix-group</var></syntax>
34 <default>Group #-1</default>
35 <contextlist><context>server config</context></contextlist>
36 <compatibility>Only valid in global server config since Apache
40 <p>The <directive>Group</directive> directive sets the group under
41 which the server will answer requests. In order to use this
42 directive, the server must be run initially as <code>root</code>. If
43 you start the server as a non-root user, it will fail to change to the
44 specified group, and will instead continue to run as the group of the
45 original user. <var>Unix-group</var> is one of:</p>
49 <dd>Refers to the given group by name.</dd>
51 <dt><code>#</code> followed by a group number.</dt>
52 <dd>Refers to a group by its number.</dd>
55 <example><title>Example</title>
59 <p>It is recommended that you set up a new group specifically for
60 running the server. Some admins use user <code>nobody</code>,
61 but this is not always possible or desirable.</p>
63 <note type="warning"><title>Security</title>
64 <p>Don't set <directive>Group</directive> (or <directive
65 module="mod_unixd">User</directive>) to <code>root</code> unless
66 you know exactly what you are doing, and what the dangers are.</p>
70 <seealso><directive module="mod_privileges">VHostGroup</directive></seealso>
71 <seealso><directive module="mod_suexec">SuexecUserGroup</directive></seealso>
76 <description>The userid under which the server will answer
77 requests</description>
78 <syntax>User <var>unix-userid</var></syntax>
79 <default>User #-1</default>
80 <contextlist><context>server config</context></contextlist>
81 <compatibility>Only valid in global server config since Apache
85 <p>The <directive>User</directive> directive sets the user ID as
86 which the server will answer requests. In order to use this
87 directive, the server must be run initially as <code>root</code>.
88 If you start the server as a non-root user, it will fail to change
89 to the lesser privileged user, and will instead continue to run as
90 that original user. If you do start the server as <code>root</code>,
91 then it is normal for the parent process to remain running as root.
92 <var>Unix-userid</var> is one of:</p>
96 <dd>Refers to the given user by name.</dd>
98 <dt># followed by a user number.</dt>
99 <dd>Refers to a user by its number.</dd>
102 <p>The user should have no privileges that result in it being
103 able to access files that are not intended to be visible to the
104 outside world, and similarly, the user should not be able to
105 execute code that is not meant for HTTP requests. It is
106 recommended that you set up a new user and group specifically for
107 running the server. Some admins use user <code>nobody</code>, but
108 this is not always desirable, since the <code>nobody</code> user
109 can have other uses on the system.</p>
111 <note type="warning"><title>Security</title>
112 <p>Don't set <directive>User</directive> (or <directive
113 module="mod_unixd">Group</directive>) to <code>root</code> unless
114 you know exactly what you are doing, and what the dangers are.</p>
118 <seealso><directive module="mod_privileges">VHostUser</directive></seealso>
119 <seealso><directive module="mod_suexec">SuexecUserGroup</directive></seealso>
123 <name>ChrootDir</name>
124 <description>Directory for apache to run chroot(8) after startup.</description>
125 <syntax>ChrootDir <var>/path/to/directory</var></syntax>
126 <default>none</default>
127 <contextlist><context>server config</context></contextlist>
128 <modulelist><module>mod_unixd</module></modulelist>
131 <p>This directive, available in httpd 2.2.9(?) and later, tells the
132 server to <var>chroot(8)</var> to the specified directory after
133 startup, but before accepting requests over the 'net.</p>
134 <p>Note that running the server under chroot is not simple,
135 and requires additional setup, particularly if you are running
136 scripts such as CGI or PHP. Please make sure you are properly
137 familiar with the operation of chroot before attempting to use