mod_unixd
Basic (required) security for Unix-family platforms.
Base
mod_unixd.c
unixd_module
suEXEC support
Group
Group under which the server will answer requests
Group unix-group
Group #-1
server config

The Group directive sets the group under which the server will answer requests. In order to use this directive, the server must be run initially as `root`. If you start the server as a non-root user, it will fail to change to the specified group, and will instead continue to run as the group of the original user. Unix-group is one of:

A group name
  Refers to the given group by name.
`#` followed by a group number.
  Refers to a group by its number.

# Example

Group www-group

It is recommended that you set up a new group specifically for running the server. Some admins use user `nobody`, but this is not always possible or desirable.

# Security

Don't set Group (or User) to `root` unless you know exactly what you are doing, and what the dangers are.

VHostGroup
SuexecUserGroup
User
The userid under which the server will answer requests
User unix-userid
User #-1
server config

The User directive sets the user ID as which the server will answer requests. In order to use this directive, the server must be run initially as `root`. If you start the server as a non-root user, it will fail to change to the lesser privileged user, and will instead continue to run as that original user. If you do start the server as `root`, then it is normal for the parent process to remain running as root. Unix-userid is one of:

A username
  Refers to the given user by name.
# followed by a user number.
  Refers to a user by its number.

The user should have no privileges that result in it being able to access files that are not intended to be visible to the outside world, and similarly, the user should not be able to execute code that is not meant for HTTP requests. It is recommended that you set up a new user and group specifically for running the server. Some admins use user `nobody`, but this is not always desirable, since the `nobody` user can have other uses on the system.

# Security

Don't set User (or Group) to `root` unless you know exactly what you are doing, and what the dangers are.

VHostUser
SuexecUserGroup
ChrootDir
Directory for apache to run chroot(8) after startup.
ChrootDir /path/to/directory
none
server config
mod_unixd

This directive tells the server to chroot(8) to the specified directory after startup, but before accepting requests over the 'net.

Note that running the server under chroot is not simple, and requires additional setup, particularly if you are running scripts such as CGI or PHP. Please make sure you are properly familiar with the operation of chroot before attempting to use this feature.

Suexec
Enable or disable the suEXEC feature
Suexec On|Off
On if suexec binary exists with proper owner and mode, Off otherwise
server config

When On, startup will fail if the suexec binary doesn't exist or has an invalid owner or file mode.

When Off, suEXEC will be disabled even if the suexec binary exists and has a valid owner and file mode.