I'd like advice about permissions on directories and files on a web/ftp server.
Here is my situation:
Debian Server with those user:group
File system :
-[/srv/data_disk] -[Websites] -[site1.tld] -... -[site2.tld] -... -[Webapps] -[App1] -... -[App2] -... -config1.php -config1.php
- Files and dirirectories in
siteX.tldwill be uploaded by ftpuser.
- There is a "upload" subdir in
www-datawill be able to create directories and write files.
- Ftpuser should be able to delete those files created by
AppXdirectories are created by
- they should be read by
www-data(with a special directory where apache should be able to create/delete files)
- And be accessible by
ftpuserin read-only mode (for remote updates purposes)
What I thought to do (but I need confirmation that it is a good practice) is make:
ftpuser=> member of
www-data=> member of
userme=> member of
And then I will
chmod as follows :
-[/srv/data_disk] => userme:userme 700 -[Websites] -[site1.tld] => ftpuser:ftpgroup 750 -... => ftp uploaded dirs/files = ftpuser:ftpgroup 750 => apache uploaded dirs/files = www-data:www-data 770 -[Webapps] => userme:userme 750 -[App1] => userme:userme 755 -... => ssh uploaded dirs/files = userme:userme 755 => apache created files = www-data:www-data 775
Does it sounds safe to you? Ftpusers are chrooted so as apache...