<p>While the parent process is usually started as root under
Unix in order to bind to port 80, the child processes and
threads are launched by Apache as a less-privileged user. The
<code class="directive"><a href="../mod/mpm_common.html#user">User</a></code> and <code class="directive"><a href="../mod/mpm_common.html#group">Group</a></code> directives are used to
set the privileges of the Apache child processes. The child
processes must be able to read all the content that will be
served, but should have as few privileges beyond that as
possible. In addition, unless <a href="../suexec.html">suexec</a> is used, these directives also
set the privileges which will be inherited by CGI scripts.</p>
server recycles processes by killing old ones and launching new
ones.</p>
<h3><a name="user-ids" id="user-ids">Working with different user-IDs</a></h3>
<p>The <code class="module"><a href="../mod/perchild.html">perchild</a></code> MPM adds the extra ability to
specify that particular processes should serve requests under
different user-IDs. These user-IDs can then be associated with
specific virtual hosts. You have to use one <code class="directive"><a href="#childperuserid">ChildPerUserID</a></code> directive for
every user/group combination you want to be run. Then you can tie
particular virtual hosts to that user and group IDs.</p>
<p>The following example runs 7 child processes. Two of them are run
under <code>user1</code>/<code>group1</code>. The next four are run
under <code>user2</code>/<code>group2</code> and the remaining
process uses the <code class="directive"><a href="../mod/mpm_common.html#user">User</a></code> and <code class="directive"><a href="../mod/mpm_common.html#group">Group</a></code>
<p>Tie a virtual host to a specific user/group combination. Requests
addressed to the virtual host where this directive appears will be
served by a process running with the specified user and group ID.</p>
<p>The user and group ID has to be assigned to a number of children
in the global server config using the <code class="directive"><a href="#childperuserid">ChildPerUserID</a></code> directive. See the section above for a
<p>Specify a user ID and group ID for a number of child processes.
The third argument, <var>num-children</var>, is the number of child
processes to start with the specified user and group. It does
<em>not</em> represent a specific child number. In order to use this
directive, the server must be run initially as <code>root</code>.
If you start the server as a non-root user, it will fail to change
to the lesser privileged user.</p>
<p>If the total number of child processes, found by totaling all of the
third arguments to all <code class="directive">ChildPerUserID</code> directives
in the config file, is less than <code class="directive"><a href="#numservers">NumServers</a></code>, then all remaining children will inherit the
<code class="directive"><a href="../mod/mpm_common.html#user">User</a></code> and <code class="directive"><a href="../mod/mpm_common.html#group">Group</a></code> settings from the main server.
See the section above for a <a href="#user-ids">configuration
example</a>.</p>
<div class="warning"><h3>Security</h3>
<p>Don't set <var>user-id</var> (or <var>group-id</var>) to
<code>root</code> unless you know exactly what you are doing, and
<p>This directive sets the maximum number of threads that will be
created in each child process. To increase this value beyond its
default, it is necessary to change the value of the <code class="directive"><a href="../mod/mpm_common.html#threadlimit">ThreadLimit</a></code> directive and stop and
