when setting up a webserver on linux , is it a good practice to make a new user and install everything under that user?

Question

I want to set up a webserver and I understand that when using linux its not safe to install things under root. So should I install things like apache and php under a different user? And if i do, will everything be installed in the /usr directory?

Answer 1

When using Linux you should not run things as root unless it's essential. This means that most installations will actually be done as root, normally by using the sudo command (or the GUI equivalent) as this ensures that all the files can be put in the right locations, with most files being below the /usr directory.

The Apache developers are well aware of security concerns and, by default, will install the webserver to run as a specially created user; on my system, most of the apache2 instances are running under the user www-data which I believe is the default (it's a long time since I installed it).

I think you can override the default locations for the actual web files during installation, but normal practice is to use the default (/var/www as I recall) and then link subfolders to there.

In summary, taking the defaults of the installation (run as root or using sudo) will give you a reasonably safe setup and you don't need to take any special action.