OP is running Debian 9. On Debian 9, the coturn package has a start script (only) available as sysv init script, and while the start scripts already takes some actions in relation to user turnserver, coturn is still run as root.
On Debian 10, while the same sysv script will probably behave the same, there's also a coturn.service
file, which starts coturn with User=turnserver
and Group=turnserver
, so systemd will use it.
The good news is that there's already a stretch-backport version of this package, currently version 4.5.1.0-1~bpo9+1. So one just has to add the stretch-backports repository and upgrade the coturn package, as documented there: https://backports.debian.org/Instructions/ (but using stretch-backports rather than buster-backports).
The service will then run as the dedicated user turnserver.