Why is it safer to set up users?

Question

Everyone is telling me that using users will make the server a lot safer. But why does it?

If I have a root account and 1 user, then I have 2 ways to enter my vps.
If someone has my root password they still can do everything with it. With my user password they can make some changes as well.

If I only use my root account, then I only have one account that can be hacked/leaked. Of course, a hacker will get total access but they would also get that access if they hacked the root of a server with users.

Edit: If you create users, where do you create them for? I'm a webdeveloper and I host my websites on my server. Do I have to create a new user for each website and each program I install or should I create only one user that I can do everything with?

Answer 1

Your password is not going to be "hacked" or "leaked".

If you're worried about attacks, a more plausible thing is that an attacker may use a zero-day vulnerability to execute some code on your server, typically with the privileges of the user running the vulnerable program. If the vulnerabile program is run by root, then the attacker can do whatever it wants on your system. This is, remember, without ever having to obtain your password.

If, on the other hand, the process is run by an ordinary user, then the attacker will be constrained by what that user can do, and in particular it will not be able to read or modify any file which that user cannot access.

For a simple Web development server, you do not need to create any account other than the one you use to log on the machine. The Web server process will normally be run by another account which is created automatically (e.g.,www-data for Apache)