Linux users and groups for a LAMP server

Question

What is the best practice for setting up a LAMP server in terms of linux users and groups? If there are multiple sites hosted on the same server, is it best to have a single user that owns all site source files (and uploads) that is in the same group as apache - or to have a different user for each site (so that each site has its own crontab)? Or something else entirely?

For some reason, this question never seems to be addressed in PHP/MySQL/Linux books that I've encountered.

Answer 1

On our platform each site's htdocs etc has it's own user. This means if one site is compromised, the others should be fine.

Answer 2

If this is a small number of large sites, you may find that splitting your server into multiple VMs using something like Xen is a better option than simply segregating by user. This will improve the isolation of your sites, and make it easier to move a site to its own hardware if, in future, one starts to become much heavier on resource usage than the others.