Why is apache2 running as root on my Lubuntu? I use a small netbook to run a web crawler, and it uses Lubuntu with minimal applications. I have definitely never installed apache on this machine. ps is showing it running as root user as well as my user ID. I uninstalled it and the process is gone. But why was it there to begin with? |
Or by chance does your crawler or some other package have a web UI that utilizes Apache as a dependency but you perhaps have always used the CLI? By default apache should not be running as root. There should be an suexec in the configuration file and the child processes should be running as a non-root service account. Are there any comments possibly left by a script in the config?
Do you have package installation logs in /var/log somewhere? I dont use the Ubuntu variants so not sure which log this would be. Maybe /var/log/apt/? or /var/log/dpkg.log or maybe there are entries in /var/log/messages? Packages installed just prior to or just after apache2 may give some clues as to what pulled it in as a dependency.
Everywhere I've run apache, it runs the control process as root, and the serving processes as (nobody|www|something); that way it can open new sockets when reloading the config, if required, before forking new serving processes. There's ways you can avoid a root control process, but that's going to be the default, as it's the easiest way to achieve the results people usually want.
I would first check all the logs. Also look in /var/log/audit/audit.log if you have auditd enabled.
As toast0 said, you’ll see multiple processes with different users.
Why it was there I don’t know :)