www user than root

[Jeremie Le Hen]

> Most daemons that bind to "priveleged" ports and run as a non-root uid,
> start as root, then change the effective UID after binding to the port.

Yes.  Secure programs like Postfix (smtp), OpenSSH, vsftpd and Dovecot
(imap) use privilege separation.  For instance if you need to open the
TCP port 80 lately, you could use a separate process for this purpose
only and communicate through it (through a UNIX socket).  There is
obviously some performance degradation if you need to use high speed
communications, but this is a trade-off if you really need to open a
privileged port lately and you want security.

Regards,
-- 
Jeremie Le Hen
< jeremie at le-hen dot org >< ttz at chchile dot org >