I am attempting to allow a wordpress installation to install plugins. I am not quite sure how to securely set the permissions of my wordpress installation. I think chown -R www-data on the entire installation would work, but I think that is insecure.
Instead I am attempting to allow wordpress to install plugins via sftp/ssh. In this tutorial on how to get that working, it shows that I would need to generate a key pair to keep on the server. I thought the whole point of key pairs is that you keep the public key on the server and the private key on the computer. I realize it is probably requiring this because the wordpress installer is on the server (the installer needs the private key) and the destination is the wordpress installation.
So am I being ridiculous requiring that my wordpress plugin installer script must ssh into a sub-directory of where it exists? If so, why are people raving about this as a secure way to install plugins?
If the better option is to set permissions, does anyone know how to securely set the proper permissions for my wordpress installation?