Linux users and groups for a LAMP server

Question

What is the best practice for setting up a LAMP server in terms of linux users and groups? If there are multiple sites hosted on the same server, is it best to have a single us

Answer 1

If this is a small number of large sites, you may find that splitting your server into multiple VMs using something like Xen is a better option than simply segregating by user. This will improve the isolation of your sites, and make it easier to move a site to its own hardware if, in future, one starts to become much heavier on resource usage than the others.

Answer 2

On our platform each site's htdocs etc has it's own user. This means if one site is compromised, the others should be fine.

Answer 3

I assume you don't want to go crazy and get WHM for cPanel and may want to do this inexpesnively.

I think its a best practice to have each user access their space from their own username and group - especially if unrelated users may be using the webserver.

If you have over 10 domains and users and want to keep accounts segregated to their own space, I would consider using Webmin with VirtualMin installed on the server. This easily handles these type of issues, within a nice, free install. Otherwise, you'll have to purchase a commercial product or handle everything manually - a real pain, but it can be done (not recommended for a commercial venture).

Also, Xen and VMS might be overkill, but also not as easy to manage as Webmin/VirtualMin for 10-100+ accounts.

Answer 4

I did some kind of small level hosting over several years and my answer is "It depends".

First of all there is a difference between Apache Module (mod_php). CGI and FastCGI. A good list with all the pros and cons could be found here: Apache php modes

When it comes to security all of the modes have pros and cons.

Since we only hosted a relatively small amount of Domains with moderate traffic I decided to stay with mod_php and used vhost configuration.

I also used different FTP users for each vhost root dir (of course).

Configuring vhosts (one per customer) allows you to switch off domains the easy way without digging your way through a ridiculously big httpd.conf and producing errors on the way.

Answer 5

The best choice is create VirtualHost for each domain using Apache with suPHP module. By this way, each site will be owned by an user and run with that user's permission. Webroot of each site should be put under user's homedir to prevent local attack.

If you use the same user for every websites, that means user from websiteA can access read/write to files of websiteB.