I have a public Linux server running CentOS, Apache/PHP/MySQL. This server currently hosts multiple WordPress Blogs and Websites I am developing.
Currently, I have "userdir" enabled, and set up virtualhosts for each website. Under each user directory there is a htdocs file which is the root directory for each website.
- Apache needs the necessary read/write permissions to the web files
- The user needs to be able to read/write so I can upload the files from my IDE
For the permissions, I add the user "apache" to the user group. For example if I have a user called 'mark', I will run "usermod -a -G mark,apache apache", and then do "chmod -R 770 /home/mark/htdocs" to give Apache access to the web files. The problem with this is that Apache can read/write/execute on everything. I suppose this is bad for security because Apache should only be able to write and execute directories it needs to.
My question is, what is the optimal way to configure the server so:
- Apache can read all files in the web root and write to directories it needs to (for uploads etc...)
- The user account can have full control so that I can upload/modify files as I develop the websites
For the permissions, I add the user "apache" to the user group.
. Uhm. Apache has its own group so that if (or rather, when if you use an Internet facing website) it gets comprimised it can do little harm. If you add it to users you just disabled that security. (hint: leave it to its own user group our to user 'none'). You already seem aware that this is not the right way, but repeating that fact will do no harm.