Trying to lauch apachectl
I get the error
(13)Permission denied: AH00091: httpd: could not open
error log file /private/var/log/apache2/error_log. AH00015: Unable to
open logs
How can I safely solve? Without messing with the permissions I mean
Ask Different is a question and answer site for power users of Apple hardware and software. It only takes a minute to sign up.
Sign up to join this communityTrying to lauch apachectl
I get the error
(13)Permission denied: AH00091: httpd: could not open
error log file /private/var/log/apache2/error_log. AH00015: Unable to
open logs
How can I safely solve? Without messing with the permissions I mean
Based on that message I'm assuming you're attempting to run as your user. You need to start Apache with elevated privileges so that it can access the directory /private/var/log/apache2
and file /private/var/log/apache2/error_log
.
Try running it like this instead:
$ sudo apachectl start
Or if it's already running:
$ sudo apachectl restart
If you take a look at the results of the above apachectl
script it should look something like this:
The httpd
process running as root is not the process that will be accepting connections, it'll start up more worker instances of httpd
that'll do the actually servicing of TCP connections to access attempts on ports 80/443.
This will isolate any access so that it's through the worker instances which are running as the user _www
, NOT root
.
This type of interaction is typical with *ctl
scripts which will require root
privileges to access the filesystem for logs and require elevated privileges to bind a process to a port that's below 1024. This is a semi-magical number in TCP ports that denotes anything that's system's related whereas ports > 1024 any user can bind to.
This is what's traditionally called a service account or service user. This account's sole purpose is to own the processes that run as services, such as Apache webservers (httpd
). Again this is for security/permission isolation on the off chance something bad happens, only the files and level of permissions granted to this user, _www
, would be what's exposed to any break-ins.
You can use the id
command in a terminal to see details about this service account.
$ id -a _www
uid=70(_www) gid=70(_www) groups=70(_www),12(everyone),61(localaccounts),701(com.apple.sharepoint.group.1),702(com.apple.sharepoint.group.2),100(_lpoperator)
httpd
is running as. In this example it's the user _www
. If you use the id -a _www
you can see the group names along with the UID + GID that are associated with this user account.
_www
user directly or one of the groups that user's a member of based on the id -a _www
output.