About APACHE's configuration file httpd.conf [transfer] (2)_PHP tutorial

#ExtendedStatus On

The Apache server can report its own running status through a special HTTP request. Turning on this

ExtendedStatus parameter allows the server to report more comprehensive running status information.
　

Main server settings

The Apache server requires various settings to define itself using various parameters to provide web services. For the case of using a virtual host, in addition to the settings overridden in the definition of the virtual host (some settings must be redefined), the settings here are also the default settings of the virtual host.
　

　Port 80

　Port defines the port used by the httpd daemon in Standalone mode. The standard port is 80. This option is only valid for servers started in standalone mode. For servers started in inetd mode, which port to use is defined in inetd.conf.
　

Using port 80 under Unix requires root permissions. For security reasons, some administrators believe that the httpd server cannot have security vulnerabilities, so they prefer to use the permissions of ordinary users to start the server. This way You cannot use port 80 and other ports smaller than 1024, but must use a port larger than 1024 to start httpd. Generally, 8000 or 8080 are also commonly used ports. The Apache httpd server itself can open port 80 with root privileges and then change it to run as an ordinary user. This reduces the risk and therefore does not need to consider this security issue. But if ordinary users also want to install and configure their own WWW server, they have to use a port greater than 1024.


User nobody

Group nogroup

User and Group configuration are the security guarantees of Apache. After Apache opens the port, it sets itself to These two options set the user and group permissions to run, thus reducing the risk of the server. This option is also only used in Standalone mode. Inetd mode specifies the user running Apache in inetd.conf. Since the server must perform the setuid() operation to change the identity, the initial process should have root privileges. If a non-root user is used to start Aapche, this configuration will not work.
　

The default settings are nobody and nogroup. This user and group do not own files in the system, ensuring that the server itself and the CGI process started by it do not have permission to change the file system. In some cases, for example, in order to run CGI and interact with Unix, the server also needs to access files on the server. If nobody and nogroup are still used, files belonging to nobody will appear in the system, which is detrimental to system security. , because other programs will also perform certain operations with the permissions of nobody and nogroup, it is possible to access files owned by these nobody, causing security problems. Normally you set a specific user and group for the Web service and change the user and group settings here.