I'm working with a dedicated CentOS server where the base exposed webdirectory is /var/www/html

For security, who should own the html directory "root" or "apache"?

The perms are drwxrwxr-x (are those optimal?)

2 Answers 2


The DocumentRoot should be owned by who will update it; don't make that root unless you want only root to do the updating. The apache user is nologin'd on CentOS by default, so it's also not the account you should be using to update the contents of the DocumentRoot. I typically leave the directory owned to apache, but grouped to a secondary group I set up for users who will have permission to modify the contents of the web root (chown apache:webusers /path/to/docroot), and chmod 770 /path/to/docroot.


Root ownership will prevent apache from being able to make any changes to its DocRoot.

If you have just one site, you can get a lot of security by enabling selinux if its disabled. If you need access to network resources, its possible with selinux to say just mysql access, or just memcache access.

  • Does apache typically need to make changes to the docroot? That's what I'm unsure about. For example when would apache need to make changes to the docroot?
    – JMC
    Jan 13, 2012 at 20:49
  • To clarify my question, any file within the docroot that requires apache modification is currently owned by apache. the other files are nouser. So I'm asking does apache have any reason to change the docroot directory specifically not files contained within it.
    – JMC
    Jan 13, 2012 at 21:12
  • The only reason apache would need ownership of the docroot in this case is if it needs to add files to the doc root directory. Jan 13, 2012 at 21:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .