I've been learning the Linux OS over the last year or so and I am still very confused on how permissions vary from different configurations. I am trying to set up my local development environment and in so doing I notice that on the production VPS (CentOS), my file/directory permissions behave differently than my local setup (Mint).
The remote server file structure has been set up where owner and group are
myuser:myuser and rwx permissions are set to 755 for directories and 644 for files which works fine with the website's requirements. However, I have to change ownership to
www-data:www-data and permissions on some folders to 777 in order to have it work the same locally. I've added myuser to the Apache group but the problem persists.
That leads me to believe that my local shell user differs from my local Apache user, and that on the remote system, the shell and Apache users are the same. Is this right?
I'm concerned about the security implications of changing these settings. I've read that you shouldn't give the web server write access. However, drupal requires it on the file repository dir called "files" and although the remote system files are owned by
myuser:myuser (and if that user is the Apache user) then doesn't that mean the web server still has write access?
So then what determines how these users should be set up? I assume that I'll be changing the Apache run user and or group but could someone explain the method and best practices for doing so? Should the same rules apply for local vs remote?