Installing as root

Question

I believe that it's not secure to install an application whilst logged in as "root". The hosting image I used doesn't create a non-root sudo user by default, when the server boots you log in as root@servername not as a sudo user created during boot up that would happen if I installed from ISO.

If I install an application whilst logged on as root, can the process owner be changed without reinstalling the application or is it more about who "starts" the application?

Answer 1

OK, so I know you shouldn't install as root

Ubuntu is installed by default with a sudo administration. That does not mean it can not be used as a root based system. It is just considered a bit more secure: 1. nobody knows you use an admin named root so they need to find out what your admin account is. 2. Logging information with sudo is done with the user that is doing it; on a root based system it will be logged as root. And then there is the obvious one: root makes it possible to wreck your system easier than a sudo based system lets you. Those are the main reason for using a sudo based system. The other thing: everything you find on the web will be sudo based instructions.

is there a way to change the user it runs as

Yes. Even with a sudo based system it is advisable to change the user apache uses. apache or www-data is probably the user apache is installed with.

See

/etc/apache2/envvars

and

export APACHE_RUN_USER=www-data
export APACHE_RUN_GROUP=www-data

Make sure to chown your website root directory and files in it to that user and group. You could also make a different group than user so you can add users to that group not part of the website but able to write to it (from scripts running on the machine for instance).

If you log in with a different user, does it still run under root because root installed it?

Depends on how you set up the user. sudo still works on an Ubuntu based system with root enable so you can still create admin accounts (basically to kill sudo you could delete the sudo group).

Basically sudo is used as a security feature. Ubuntu used to be seen as a starter Linux and this was a good way to introduce Windows users to a rock solid security based multi user system. Running root is not a problem if you know what you are doing. I hope I do not offend anybody if I say that in my opinion the average Ubuntu user is just a desktop user and has below average knowledge of the command line to be trusted to run a root based system.

Debian for instance asks at the installation if you want to use root; if not sudo based system is installed.

1 important thing: make sure you use a strong password when using root and don't give it out to others.

Who is this running as, root or www-data?

• the original service is run as root
• apache then spawns childs processes that are run as the apache user (in this case www-data)

Has NOTHING to do with your system running as root. This is always the case: the main apache thread is protected from getting killed by anyone but root. You can kill the childs with the user www-data but those can and will be respawend by the main thread. In theory this should keep the website alive.