In general, when should one create a new user account to run a piece of internet-facing software on a server?
For instance, suppose I'm using a shared Debian server (e.g. via Dreamhost) and I want to run some websites using WordPress, some using Redmine, some using Ruby on Rails, maybe some using Django, and I'd like to serve Mercurial repositories too.
On Dreamhost servers and many other similarly set-up servers, this could all be done under a single user account, but I can see some drawbacks to that approach:
- A lengthier .bashrc
- If that one account becomes compromised, so do all the sites running under it.
On the other hand, having lots of user accounts could become a bit of a pain to keep track of, especially if some of them have identical requirements in terms of installed software. For instance, having one account for each website running WordPress might be overkill.
What's the best practice? Is it simply a question of reducing the number of hosted sites (or hosted repositories, etc) per user account proportionately to one's level of paranoia?
Please post your opinions on this, giving your reasons for them.
Also, if you have any reasons for thinking that the approach taken on a private server or VPS should differ from the approach taken on a shared server, please outline what they are and, again, your reasons for them.