Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just got a VPS sver the other day, I'm new to server administration, but not that new to Ubuntu (11.04). I use it in my living room as the HTPC, and I had a previous VPS that I used on and off for a team speak server. This one I'm setting up for long term use. So I would like to know the best practice when it comes to websites and tasks that I have the server proforming. I understand that it could be beneficial to separate each website into it's own usergroup or under its own username. I would setup nginx so that it could read all of the users directors (and thus each website) but could not touch anything else. The same with the TeamSpeak, should I make a user for TeamSpeak so that it operates within its own confined area or is this overkill?

I do have access to root on the sever and my current plan is to run about 4 websites and a TeamSpeak server. My stack is Linux (Ubuntu 11.04 LTS), nginx, and PHP 5.4.3 (using the PDO SQLite 3 built in driver for the database). Should PHP have it's own user group or is it ok to place it in with nginx?

share|improve this question
up vote 6 down vote accepted

Best practices for services like teamspeak are to run them as a seperate user, preferably in a jail - a guide to setting up jails can be found at

This is done to limit the damage an exploit in the software can cause - it will hopefully be limited to messing up teamspeak's files, but not the rest of the server.

Php and the webserver can often share a user since they need access to the same files.

No network service should run as root if it can be avoided because an exploit in that service could let an attacker get the same permissions as the user running it. Some software needs root permissions to start but can be configured to drop those permissions after it has started.

share|improve this answer
Can you provide a link to a guide on how to setup a service to drop its permission level after startup? – Mark Tomlin Jun 3 '12 at 0:51
It varies from program to program and should be in their documentation. Will update with a link on how to setup jails. – Grant Jun 3 '12 at 0:57
Thank you for your help! – Mark Tomlin Jun 3 '12 at 1:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.