I must admit that I lied a little when I told you that Lighttpd needs to run with root privileges—the only thing requiring them is binding to Port 80. After binding, Lighttpd can change the user, thus giving up privileges and making it a lesser target for attack. The configuration is so simple that most installation packages enable it by default:

server.username = "lighttpd"
server.groupname = "lighttpd"

This will make Lighttpd run as user lighttpd in the group lighttpd. The only thing we have to care about is that all of the files we want to serve need to be accessible, and all web applications we want to spawn need to be executable to this user or group.

It's so easy, that there is little reason not to do it. In fact, we may need to do nothing at all, because most installations do it for us by default. Just look into our lighttpd.conf file to see if the above statements, possibly with other user and group name, are there and not commented out.