permissions, files and apache2

Mohtek · 05-18-2010, 11:08 PM

I'm running a PHP based Content Management system on my web server. I have been reading up on security and want to use the "user" directive to set the server to run as a non-root user.
In the web root, does the same user own the files that the server runs as, or who should own the files?

alunduil · 05-18-2010, 11:13 PM

It's recommended that the user the process runs as also owns the files you are mentioning. The group could then be your dev group with write priveleges and the sticky bit set. Then of course either read or no privileges for everyone else. But this is just a recommended way of doing things. I wouldn't say it's a hard and fast rule or any more secure than another method someone may have developed.

Regards,

Alunduil