Today I decided to fix web-server file rights. Did only a little bit of testing to see how rights work so sorry for sounding stupid.
I have Apache web-server on Linux (LAMP) which has multiple users and domains. I'm using "Direct Admin" to partly manage web-server.
My problem concerns file rights of users webpage files. Currently all files and folders are set to 0777.
For example I have user "kksc". All files ownership in "kksc" user home directory belongs to "kksc" user and "kksc" group.
If "kksc" user files are chmoded to 0644, "apache" no longer can write to files. Writable files rights has to be changed to world-writable (0666) so that "apache" could write to them.
Most of writable files has PHP extension so 0666 seems a bad choice.
Similar problem is with folders.
I was thinking about adding "apache" user to "kksc" group and setting file rights to 0664. I don't know whether it's a good idea (adding "apache" to each user group) when main concern is security.
I need an advice. Is my solution good, keeping in mind security? Maybe there are better ways?