Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set up a simple LAMP system while keeping some basic security in mind. If I want to create a MySQL to be accessed by PHP, under what user should create databases? Any references to best practices will be greatly appriciated.


share|improve this question
up vote 2 down vote accepted

Assuming you run the whole stack, there's no reason not to run each application as its own user. You're going to have to create the accounts as root or some other privileged user, but you can either change the username of root - see step 4.5 here or create a new user with the right permissions, but i've never seen anyone do the latter.

As an aside , you might also want to restrict the mysql server to listening to localhost at the firewall level should you need to do anything, you'd have to ssh in, but it makes a compromise less likely.

share|improve this answer
Thanks for such a prompt reply and the references. – ezequiel-garzon Apr 7 '12 at 10:51

You seem to be referring to the mysql users rather than the system users, but your reference to the LAMP stack suggests a short comment on the mysql system user...

Typically for production deployment, you would install the mysql, apache, PHP/Perl from the distribution packages and hence you would run the package install command e.g. apt-get install mysql-server apache2 php or yum install httpd mysql-server php53 as the root user, or some user with sudo permissions.

The installation handles configuring users apache and mysql for those services to run as. You might notice that the files in /var/lib/mysql are owned by the mysql user, and that the mysqld process is owned by mysql.

within mysql a user requires the "CREATE" privilege to create new databases, and by default this is assigned to the root user.

I typically set a long (16 chars) password for root and store that in an off-line file, and create a second user "dba" that is used for day-to-day operations. Each database has a user account wiht write permissions only, and the root and dba user are restricted to "localhost" only

  1. Here is a good article on mysql user administration strategy
  2. THis is a more general article but has a section about mysql user strategy
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.