XAMPP or any other service tool in /opt? Security

Question

I am developing with Xampp for Linux and Tomcat (similar to Xampp on Windows). Many programs like /IDEA, Tomcat and Xampp are recommended to be installed under /opt Now I have heard that it is not recommended to run services as root, but on Ubuntu (I am using this) unpacking any directory to /opt implies that it belongs to root owner and root group. This may be specific to Xampp as per the instructions on their Linux page:

• Step 2: Installation After downloading simply type in the following commands:

  Go to a Linux shell and login as the system administrator root:

  su

  Extract the downloaded archive file to /opt:

tar xvfz xampp-linux-1.8.1.tar.gz -C /opt

 Warning: Please use only this command to install XAMPP. DON'T use any Microsoft Windows tools to extract the archive, it won't work. Warning 2: already installed XAMPP versions get overwritten by this command. 

That's all. XAMPP is now installed below the /opt/lampp directory. * Step 3: Start To start XAMPP simply call this command:

/opt/lampp/lampp start

Placing it here implies that Apache must be run as root as one is only able to run it with sudo on Ubuntu.

This may be an issue specific to Ubuntu. Is it? Because Xampp is a development tool I posted this here as I am more likely to find an appropriate answer here from developers who use it on Ubuntu (and other Linux systems). I would appreciate any information on if the same problem occurs on other systems, I notice my production environment has Tomcat installed in /opt too, but belongs to tomcat: tomcat

The question here is how to get around this for all tools under /opt, because even though Xampp may not be the tool for my needs, I still want to place Tomcat under /opt to replicate my production environment and the same thing will surely happen unless this is just a Ubuntu issue?

Answer 1

Ubuntu and some other distributions differ to the general Linux principle where the account that you create upon install of the OS is added to specific groups that can be viewed with the following command:

groups username

You will notice that root is not amongst these. It is also not possible to log in or su to the root account. sudo is most likey a command that has been granted permission to be used from other accounts so I imagine the 'sudo' command has a file permission of 775 for user: root:root

Thus launching services from /opt' does not run them as root`