From a security stand point, for me, this directory, as well as any directory that the webserver needs to go to should be set in such a way that the webserver is not the owner of the files/directories and in such a way that it has no rights to write in any directory/file.
By doing so it means, whatever breach you have in the server, would never result in more than a DOS and an exfiltration, files would not be able to be written to by the webserver.
Of course, in real life things may get more complicated as:
- some CGI/application inside the webserver may need to have write access somewhere, for example to store session data if not done with a database
- the webserver itself typically needs write access somewhere to write logfiles, etc.
- in some setup, and it can have positive security effects, each application inside the webserver could run under another UID than the webserver itself. The juggling on ownership and rights could become complicated. This is probably why you can see many times online many people saying: just put
rwx everywhere and it will work. Of course if you give everyone every right it "works" but they are consequences security wise.
So if you have like users connecting to your server to upload new files through SFTP so that they can be served by a webserver, I would:
- make each user own its specific directory with full rights for them
- make the webserver main group be the group of each user specific directory, with
rx right for it
- no rights at all for other users
By doing so, each users sees only its own files and nothing else (SFTP has also the option of chrooting for added security but this comes with its own complexities), and the webserver has access to all files only for reading.
Inside each directory you can have all files owned by the group of the webserver or even put
rx for anybody, since that will be protected by the top directory having no rights at all for other users than the owner or the webserver.