On Linux/Unix based web servers, the daemon should run under which privilege level?

On Linux/Unix based web servers, the daemon should run under which privilege level?

• A. Root
• B. Guest
• C. You cannot determine
• D. Non-root

Answer: (D)

The best practice is to run the daemon with non-root privileges. This follows the principle of least privilege: if the process is compromised, limited permissions reduce the potential damage. On Linux/Unix web servers, the daemon typically starts as root only to bind to privileged ports (like 80 or 443) and then drops privileges to a non-root user (such as www-data or nginx) for handling requests. This way, the service can perform necessary startup tasks but remains restricted during normal operation. Some setups may use capabilities to bind to ports without full root, but the ongoing operation should still run under non-root privileges to minimize risk.

The best practice is to run the daemon with non-root privileges. This follows the principle of least privilege: if the process is compromised, limited permissions reduce the potential damage. On Linux/Unix web servers, the daemon typically starts as root only to bind to privileged ports (like 80 or 443) and then drops privileges to a non-root user (such as www-data or nginx) for handling requests. This way, the service can perform necessary startup tasks but remains restricted during normal operation. Some setups may use capabilities to bind to ports without full root, but the ongoing operation should still run under non-root privileges to minimize risk.