I want to secure a file upload directory on my server as described beautifully here, but I have one problem before I can follow these instructions. I don't know what user Apache is running as.
I've found a suggestion that you can look in httpd.conf and there will be a "User" line, but there is no such line in my httpd.conf file, so I guess Apache is running as the default user. I can't find out what that is, though.
So, my question is (are):
- how do I find out what the default user is
- do I need to change the default user
- if the answer is yes and I change the default user by editing httpd.conf, is it likely to screw anything up?
Thanks!
ps aux | egrep '(apache|httpd)'
typically will show what apache is running as.Usually you do not need to change the default user, "nobody" or "apache" are typically fine users. As long as its not "root" ;)
edit: more accurate command for catching apache binaries too
You can try the following command:
Use
apachectl -S
, which will show something Apache user and group, something like this:According to the ubuntuforums.org, on Ubuntu the default user for apache2 is
www-data
.Seen to be true on Ubuntu 13.10 Saucy.
From Lars Noodén on the above forum.
For Red Hat based distributions it would be (usually its user running httpd is
apache
):I know that this is an old post, but it is still listed as unanswered, so I will make a suggestion. If you can't find which user or group Apache is running as, perhaps try opening the httpd.conf file. There should be an entry there for "User" and "Group". Not only can you see which user Apache is supposed to be running as, but you can change it if you feel the need to do so.
You can include a line of code in your PHP script:
This code will - more or less - alphabetically list all the non-root users running processes containing
apache
(or whose name containsapache
)ps aux | grep apache
while it is running.NOTE: This is the same answer I gave on Stackoverflow.
Or you can check the apache configuration file and look for the owner & group.
An alternative approach, at least for Debian/Ubuntu-based distros, is to use the same method Apache does to set its user and group: source
/etc/apache2/envvars
!If you want to get fancy, you can suppress errors if the file is not found, and provide a default value: