Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to run apache as root ( I know this is unadvised but I need to since this is a test server and I don't really care for security).

I have edited the following in httpd.conf:

export APACHE_RUN_USER=root
export APACHE_RUN_GROUP=root

When I restart apache I get the error:

Apache has not been designed to serve pages while running as root. There are known race conditions that will allow any local user to read any file on the system. If you still desire to serve pages as root then add -DBIG_SECURITY_HOLE to the CFLAGS env variable and then rebuild the server. It is strongly suggested that you instead modify the User directive in your httpd.conf file to list a non-root user.

httpd (pid 28449) already running

I need to know how to rebuild the server, I cant find the ./configure script since I used yum install httpd on centos.

If I can get directions on how to do this I'd really appreciate it!

share|improve this question

migrated from Aug 13 '12 at 21:13

This question came from our site for professional and enthusiast programmers.

Just don't do it ! – Iain Aug 13 '12 at 21:18
It isn't just about security. You're trying to rebuild the binary you use in your test environment to be completely different from what you run in production. At that point, your "test" environment isn't providing a valid test model for your deployment setup. – khoxsey Aug 13 '12 at 21:33
Quite frankly if you can't figure out how to do this without asking someone YOU HAVE NO BUSINESS DOING IT. I'm not trying to be mean, but there is a reason there are Big Dire Warnings that can only be eliminated by manually re-compiling the server with flags that aren't even accessible through the configure script and have to be added to the options list by hand. You are almost certainly doing something wrong if you "need" this capability... – voretaq7 Aug 13 '12 at 21:49
The error you pasted already tells you what to do. But as other people have pointed it, this is a dumb idea for so many reasons. It doesn't matter if its a test server, its pointless testing something on an environment that completely differs from anything you'd ever put live on the net – carpii Aug 13 '12 at 23:00
@voretaq7 I am so tired of answers like yours it contributes nothing. My situation is teaching students why it is a bad idea; so I do in fact need to be able to run apache as root without people like you constantly reminding me the point I'm teaching. – David Jan 3 '13 at 2:11

You have installed a pre-compiled build of Apache, which does not support running as root. You have two choices:

  1. Don't try to run Apache as root. It's not that hard to set up properly.
  2. Get the source code for Apache and rebuild it with -DBIG_SECURITY_HOLE as described in the message.
share|improve this answer

you should never have to run apache as root and changing the owner/permissions will actually make apache throw exceptions and terminate execution unless you use Greg Hewgill's solution to use the debuging security hole parameter on compile. I think the better question is, why on earth do you need to run apache as root?

share|improve this answer
He said he already knows these thing and he said it's a test server without any security needed (probably he has it on a virtual machine, too). Try to give an answer if you can. – Zagorax Jun 27 '12 at 22:47
The problem with that is that if you get in the habit of ignoring security in your test environment, you'll surely get in the habit of ignoring security in production. This leads to Bad Things like network intrusion and job loss. – Michael Hampton Aug 13 '12 at 21:22
I can see it's probable use in the case of debugging a complex issue.. But it seems like a lot of work to go through for a debugging process that might not garnish any results at all. It all depends on what kind of testing is being conducted.. Maybe the apache server is transparent to the test and just there for the convenience of reporting, but then why does it need to be root? – Rusty Weber Jul 15 '13 at 20:37

If you ran yum install httpd, you don't have the source installed. You can download the source here

Otherwise, you should be able to download the source with yumdownloader:

yum install yum-utils
yumdownloader --source httpd

This will download the source in your current working directory. Then you can compile it with the configure option suggested in the error.

Follow this guide to add source repo to Centos.

If you don't want to add any new repo to your centos installation, you may download only the source file for httpd from here.

share|improve this answer
when i try to do that I get No source RPM found for httpd-2.2.15-15.el6.centos.x86_64 No source RPM found for httpd-2.2.15-15.el6.centos.1.x86_64 Nothing to download – user1371011 Jun 28 '12 at 1:45
It seems you don't have rmp source repo enabled. I added a link to a guide in the answer, if that doesn't work, consider downloading the source from apache official site. – Zagorax Jun 28 '12 at 8:02
That's stretching it pretty far. I don't use Apache on any production servers and sure as hell wouldn't allow it to run as root on them. It'd certainly be nice to be able to run apache as root on an isolated workstation so I don't have to muck about with permissions for projects in my home directory. – Jonathan Dumaine Jul 8 '13 at 18:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.