I'm trying to set up a simple LAMP system while keeping some basic security in mind. If I want to create a MySQL to be accessed by PHP, under what user should create databases? Any references to best practices will be greatly appriciated.
Assuming you run the whole stack, there's no reason not to run each application as its own user. You're going to have to create the accounts as root or some other privileged user, but you can either change the username of root - see step 4.5 here or create a new user with the right permissions, but i've never seen anyone do the latter.
As an aside , you might also want to restrict the mysql server to listening to localhost at the firewall level should you need to do anything, you'd have to ssh in, but it makes a compromise less likely.
You seem to be referring to the mysql users rather than the system users, but your reference to the LAMP stack suggests a short comment on the mysql system user...
Typically for production deployment, you would install the mysql, apache, PHP/Perl from the distribution packages and hence you would run the package install command e.g.
The installation handles configuring users apache and mysql for those services to run as. You might notice that the files in /var/lib/mysql are owned by the mysql user, and that the mysqld process is owned by mysql.
within mysql a user requires the "CREATE" privilege to create new databases, and by default this is assigned to the root user.
I typically set a long (16 chars) password for root and store that in an off-line file, and create a second user "dba" that is used for day-to-day operations. Each database has a user account wiht write permissions only, and the root and dba user are restricted to "localhost" only