Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working with a dedicated CentOS server where the base exposed webdirectory is /var/www/html

For security, who should own the html directory "root" or "apache"?

The perms are drwxrwxr-x (are those optimal?)

share|improve this question
up vote 2 down vote accepted

The DocumentRoot should be owned by who will update it; don't make that root unless you want only root to do the updating. The apache user is nologin'd on CentOS by default, so it's also not the account you should be using to update the contents of the DocumentRoot. I typically leave the directory owned to apache, but grouped to a secondary group I set up for users who will have permission to modify the contents of the web root (chown apache:webusers /path/to/docroot), and chmod 770 /path/to/docroot.

share|improve this answer

Root ownership will prevent apache from being able to make any changes to its DocRoot.

If you have just one site, you can get a lot of security by enabling selinux if its disabled. If you need access to network resources, its possible with selinux to say just mysql access, or just memcache access.

share|improve this answer
Does apache typically need to make changes to the docroot? That's what I'm unsure about. For example when would apache need to make changes to the docroot? – JMC Jan 13 '12 at 20:49
To clarify my question, any file within the docroot that requires apache modification is currently owned by apache. the other files are nouser. So I'm asking does apache have any reason to change the docroot directory specifically not files contained within it. – JMC Jan 13 '12 at 21:12
The only reason apache would need ownership of the docroot in this case is if it needs to add files to the doc root directory. – becomingwisest Jan 13 '12 at 21:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.