Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
I'm configuring Apache 2 on CentOS 4 (roughly equivalent to Red Hat). There are two users related to security for httpd: apache and www.
It seems to me that apache is the user the web server actually runs as, while www is the user that owns all the files in the document root.
Why are there separate users? Why not just have apache own all those files as well?
It sounds like you or someone else created an extra user/group for you called www. The standard on Red Hat/CentOS is to have the apache httpd process run as the apache user, which gets created when you install the httpd rpm. Depending on your situation and how secure you want your website to be, you can either have your content owned by apache (less secure, but then the webserver can write files easier if you need that kind of thing) or you can have the website content owned by another user and world readable. Such as mode 644 for files and mode 755 for directories leading to those files. There should be a default document root directory at /var/www/html that you can put website files in.
Just an FYI, if you are using CentOS 4, you are way behind. Even CentOS 5 is way behind and CentOS 6 should be available in hopefully a month or less (Its not CentOS's fault, Red Hat delayed 6 by over a year). If you are going to run a serious website, I'd recommend upgrading. Especially if you are going to try to run any applications with PHP. Wait for 6 to come out, which will have PHP 5.3
Not sure how you ended up that way (in my case, the website files are owned by me), but there is a good reason for having the files served by the webserver not owned by/writable by the webserver: if someone exploits the webserver they can't alter the website without a separate privilege escalation exploit.
It gives you the possibility to do more fine grained security configuration with SELinux. Each user can than have only the privileges need, e.g. apache has the rights to start processes and access the network, while www can only read files.
For more details, take a look at this post.
