Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some static files that I would like to serve via Apache to a website which uses basic authentication to restrict access. In addition, I want to be able to prevent people with login accounts on the web server from accessing these files.

What's the best way to achieve this? The simplest thing would be to have the restricted files owned by the web server account ("apache", in my case, as I'm running on Fedora). However, this thread suggests that allowing the web server user to own anything in the www root is a bad idea from a security perspective:

As a general rule, no mechanism should exist that might theoretically allow your apache server to write to anything on your system, unless there is simply no other way of achieving a particular effect you happen to want.

The most effective ways of ensuring this include... [n]ot doing anything silly ... eg allowing your web server user to own anything in the www root.

share|improve this question
up vote 1 down vote accepted

You can use group permissions, set your files with RW access for the user you want and set access to RO for the group apache belong to.

share|improve this answer
Right, the user account that owns the file will have access (you can make it root if you really want). Also, if you really don't want users on the box to be able to read the file you need to make sure that there are no users in the group apache belongs to (which there normally wouldn't be, but you should check). – Catherine MacInnes Jun 16 '09 at 16:00
Do not forget to set directory permissions the same way (disable the write permission for apache and read/write/execute permissions for others) – zarkdav Jun 16 '09 at 16:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.