Apache runs as a specific user (usually httpd) but depending on how it is configured, PHP may run as the same or a different user:
- If PHP is run as a module, then it will be the same user as Apache.
- If PHP is run as a CGI (very uncommon) then it will usually run as the same user, unless Apache is configured to use suexec (in which case the user will be in the config).
- If PHP runs as FastCGI, then it will run as whatever user it has been configured to run as.
This is further complicated by suPHP which is similar to the situation with CGI except that the script is run with uid owning the script file.
The constraints here are that:
The dirs/files writable by the webserver uid (and the PHP uid) should be very limited and where these are writable special consideration should be put into avoiding code injection attacks.
Usually normal users cannot write files as a different uid - and presumably PHP code files need to be maintained (i.e. writable by the users.
Note that whether a PHP file is executable by the webserver has nothing to do with the executable bit on a file (but it has a lot to do with the executable bit on the directory which contains it).
Should I put the FTP user and the apache server into a group?
Probably not. I would recommend treating the webserver/PHP as "other" - so for any content (including PHP) to be accessible by the webserver, the permissions should be:
- user: read, write
- group: depends on your policy
- other read
i.e. 0644 (as above executable permissions are not relevant), and for directories:
- user: read, write, execute
- group: depends on your policy
- other: read, execute
i.e. 0755