1

Trying to lauch apachectl I get the error

(13)Permission denied: AH00091: httpd: could not open
error log file /private/var/log/apache2/error_log. AH00015: Unable to
open logs

How can I safely solve? Without messing with the permissions I mean

Improve this question

1 Answer 1

Reset to default
2

Based on that message I'm assuming you're attempting to run as your user. You need to start Apache with elevated privileges so that it can access the directory /private/var/log/apache2 and file /private/var/log/apache2/error_log.

Try running it like this instead:

$ sudo apachectl start

Or if it's already running:

$ sudo apachectl restart

Running as root?

If you take a look at the results of the above apachectl script it should look something like this:

      ss

The httpd process running as root is not the process that will be accepting connections, it'll start up more worker instances of httpd that'll do the actually servicing of TCP connections to access attempts on ports 80/443.

This will isolate any access so that it's through the worker instances which are running as the user _www, NOT root.

This type of interaction is typical with *ctl scripts which will require root privileges to access the filesystem for logs and require elevated privileges to bind a process to a port that's below 1024. This is a semi-magical number in TCP ports that denotes anything that's system's related whereas ports > 1024 any user can bind to.

What's _www?

This is what's traditionally called a service account or service user. This account's sole purpose is to own the processes that run as services, such as Apache webservers (httpd). Again this is for security/permission isolation on the off chance something bad happens, only the files and level of permissions granted to this user, _www, would be what's exposed to any break-ins.

You can use the id command in a terminal to see details about this service account.

$ id -a _www
uid=70(_www) gid=70(_www) groups=70(_www),12(everyone),61(localaccounts),701(com.apple.sharepoint.group.1),702(com.apple.sharepoint.group.2),100(_lpoperator)

References

Improve this answer
13
  • 1
    @alfredopacino - the actual apache/httpd process won't run as root, you're only being root to execute this service script.
    – slm
    Apr 28, 2019 at 12:43
  • 1
    @alfredopacino that location should be accessible/owned by whatever user httpd is running as. In this example it's the user _www. If you use the id -a _www you can see the group names along with the UID + GID that are associated with this user account.
    – slm
    Apr 28, 2019 at 12:51
  • 1
    @alfredopacino - sure thing, can you please mark this A'er as accepted so ppl know your original Q has been resolved?
    – slm
    Apr 28, 2019 at 13:11
  • 1
    @alfredopacino - might be helpful - maketecheasier.com/setup-web-server-in-mountain-lion.
    – slm
    Apr 28, 2019 at 13:18
  • 1
    @alfredopacino - you'll need to then make that directory accessible to either the _www user directly or one of the groups that user's a member of based on the id -a _www output.
    – slm
    Apr 28, 2019 at 13:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .