I'm attempting to understand some concepts surrounding security and environment variables for a web application running under Apache on Ubuntu 10.04 Server.

I have a few applications that I would like to run as a user that has no shell or password (I understand that this is a good idea, but I'm no expert). One of the applications is a web app that is started via a system init script, the others are utilities started on an ad-hoc basis from the commandline via `sudo` with the `-u` switch.

Each application needs access to the same set of environment variables. I can modify the script that starts each application, and set the environment variables there, but I would prefer it if the environment variables were somehow set for the user under which the application is run.

**My questions are:**

Is that possible to set 'per user' environment variables for a user that has no shell? I've read "[Setting environment variables for a service without a login shell on Debian](https://serverfault.com/questions/188001/setting-environment-variables-for-a-service-without-a-login-shell-on-debian)", but the given solution is essentially the same as modifying each of my application scripts.

If I cannot set the environment variables per user, what are the security risks associated with giving the user a shell?

What, if any, are the alternatives or recommendations for this presumably common situation?