History and explanation
In the early days of Unix,
... as Unix was invented as a network and multi-user operating system; you could deploy web server programs on Unix where the online user in the program was the same as (equaled) the actual user (registered in /etc/passwd with a number higher than 1000) on the Unix machine (correct me if I am wrong).
Nowadays,
...this is mostly not the case anymore. Today, every web server program, which wants to be for multiple online users, also includes multi-user support written in the same program. The web server program then only runs under one user, normally this user is called the same as the program (e.g. Apache may be deployed under the user apache or www-data).
Comparison
Disadvantages of today's normal setup
- administration is mostly only possible via the web server program (either CLI, GUI or conf files).
- I would say, administration gets a little bit more complicated and intransparent. Because by limiting it only to one user; but then creating multiple users inside the application / the applications home directory; the whole concept of multi-user operating system is misused in my perception. Isn't it better it to use things like SELinux or limiting access rights by putting those peoples in system groups:
You could for example put all online users in a system group called online-users.
Then you could deny all members of this group to execute any program on your server, except of the web server programs that you configured before. This would also make sharing data between multiple web server applications on the same server much easier.
- Every programmer, who wants to make an online web-server program; also has to program the multi-user support and harden each user from each other, so that no user can get access to other users data or passwords => double work!
- This way, online users (inside the web server application) vs system users on the server are protected very good; but the online-user-vs.-online-user-protection level on the same server depends on the programming skills of the web program programmer.
Advantages of today's normal setup:
- more security: by limiting all online action and data to only one user (so to say: sandboxing) who has got no root/sudo rights and only ONE program (without SUID bit, of course).
- portability: the web server program can also be used on non-unix systems. But come on: Windows or Mac OS X Servers are rarely used as web server operating systems; that is not a really big advantage.
Are there any more advantages? If this is the only advantage (I don't count the second one as relevant ...), I would count this whole thing as a good example where security was more important than usability / comprehensibility / transparency.
Apart from that, I think there are more advantages I did not mention.
I guess you understand what I mean; and I do not have to provide examples. If you do not not understand what I mean to say, I can give some examples.
TL;DR:
Why does no web program (for POSIX-based-OS) exist anymore today; in which:
online user, registered with web program == system user, registered in /etc/passwd with a number > 1000.
What are the advantages and disadvantages with each setup (setup today: =/=, possible setup: ==)?
I could not find any website or other serverfault question dealing with this matter more than incidentally in a sub-ordinate clause, if you know one website or question; please let me know.