I've installed Debian 11 on an old computer of mine to use for hosting my website, a Minecraft server, a Jellyfin server, and whatever else suits my fancy. I've noticed that a common sentiment seems to be that each server should be put as a different user for the vague "security reasons." What I don't understand is how giving each server their own user is preferable for security. I don't want to ignore security (I have been enabling SSL for the servers that I already have up), but there is a service that I want to try out whose install script does not create a new user and is not recommended to run as root. I suspect the implication here is that I am expected to create a non-root user before and then run the script as that user, but because I am having trouble understanding the motivations for doing that, I am not sure what it is specifically that I am avoiding by doing that and would appreciate an explanation. :)
#Why run servers under different users on one machine?
maiden hearth
jagged basalt
If one service is ‘hacked’ (shell access or something), the rest of the system is still fine. It’s for compartmentalization. The attacker can only mess up that user, not the other services.
This is all null and void though if you allow sudo or something from those users and let them access the data of the other users.