I am wondering the security risk of changing apache run user from www-data to another.

sudo vi /etc/apache2/envvars

export APACHE_RUN_USER=www-data
export APACHE_RUN_GROUP=www-data

I have change to:
export APACHE_RUN_USER=myusername
export APACHE_RUN_GROUP=myusername

My main reason for doing this is because I have ssh keys setup for myusername and it also makes managing new files created by apache a lot easier since they are no longer belonging to www-data.


As long as the running Apache process has read access to myusername's files, you should be fine.

If Apache doesn't have read permissions to myusername's files, anything you put in the docroot as myusername will be unable to be served.

  • Yes, I'm putting all my code under /home/myusername/projectfolder – Yada Nov 28 '13 at 16:44
  • As long as you only have one user for your domains, this should be fine. It would be problematic if you had other users on the system with their own domains. – etagenklo Nov 28 '13 at 19:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.