Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to secure a file upload directory on my server as described beautifully here, but I have one problem before I can follow these instructions. I don't know what user Apache is running as.

I've found a suggestion that you can look in httpd.conf and there will be a "User" line, but there is no such line in my httpd.conf file, so I guess Apache is running as the default user. I can't find out what that is, though.

So, my question is (are):

  • how do I find out what the default user is
  • do I need to change the default user
  • if the answer is yes and I change the default user by editing httpd.conf, is it likely to screw anything up?

Thanks!

----- UPDATE ------

Seems to have been answered here. Sorry, I got told off on StackOverflow and told to post it here, then posted it here, then it got answered on StackOverflow anyway!

share|improve this question
5  
why has this question been downvoted? Yes, it's been updated as it has been answered elswhere, but I see no need to down vote? It's a perfectly good question? Perhaps our down voter would care to add a constructive comment regarding this? –  Bryan Mar 24 '10 at 16:44
2  
You might want to post that update as an answer, and accept it, as you are currently in the Unanswered queue. –  fahadsadah Apr 5 '10 at 9:40
    
This question belongs here? I don't think, as it is something easy –  Eric DANNIELOU Nov 20 '13 at 13:44
1  
+1 for being told off on StackOverflow; some users seem insistent on running off new users –  wruckie Jun 7 at 18:35
add comment

9 Answers

ps aux | egrep '(apache|httpd)' typically will show what apache is running as.

Usually you do not need to change the default user, "nobody" or "apache" are typically fine users. As long as its not "root" ;)

edit: more accurate command for catching apache binaries too

share|improve this answer
4  
Yup, or it'll be www-data on Ubuntu. –  gravyface Apr 19 '10 at 23:55
1  
...and Debian. :) –  cubuspl42 Jan 28 at 13:07
add comment

I know that this is an old post, but it is still listed as unanswered, so I will make a suggestion. If you can't find which user or group Apache is running as, perhaps try opening the httpd.conf file. There should be an entry there for "User" and "Group". Not only can you see which user Apache is supposed to be running as, but you can change it if you feel the need to do so.

share|improve this answer
add comment

You can try the following command:

ps -ef | grep httpd | grep -v `whoami` | grep -v root | head -n1 | awk '{print $1}'
share|improve this answer
add comment

Or you can check the apache configuration file and look for the owner & group.

share|improve this answer
add comment

You can include a line of code in your PHP script:

echo exec('whoami');
share|improve this answer
add comment
  • To find out the user, you can simply use ps aux | grep apache while it is running.
  • You don't need to, but if Apache is running as root there are security issues.
  • Thirdly, changing the user of Apache will change his rights to access some directories. You need to make sure that /var/www (or wherever you have your websites) is accessible to the new user and group.
  • On the systems I have looked at, apache was always installed using apache:apache (or similar) as user and group, so it should probably already be set like that.

NOTE: This is the same answer I gave on Stackoverflow.

share|improve this answer
add comment

As suggested by Noyo here:

APACHE_USER=$(ps axho user,comm|grep -E "httpd|apache"|uniq|grep -v "root"|awk 'END {if ($1) print $1}')
share|improve this answer
add comment
ps aux | grep -v root | grep apache | cut -d\  -f1 | sort | uniq
share|improve this answer
add comment

According to the ubuntuforums.org, on Ubuntu the default user for apache2 is www-data.

Seen to be true on Ubuntu 13.10 Saucy.


From Lars Noodén on the above forum.

To be sure what [the user] is really set to, check the actual configuration files. The umbrella file, apache2.conf will have something like the following,

User ${APACHE_RUN_USER}
Group ${APACHE_RUN_GROUP}

That is a reference to environment variables set in /etc/apache2/envvars. mod_suexec also allows scripts to be run as yet a different user and group.

To find any virtual hosts, which may use alternate users, groups, or both, check the configurations.

$ egrep "^User|^Group|^SuexecUserGroup" /etc/apache2/apache2.conf /etc/apache2/sites-available/*.conf
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.