Secure file ownership/permission sets for different files in /var/www

Question

I'm trying to establish a set of secure ownership/permission standards for /var/www on my server. The ownership is either apache or not-apache, and the permissions are anything from 000-777.

Here's my first attempt. I don't consider myself a server admin, or security knowledgable, so I'm looking for suggestion, feedback, and corrections.

/uploads/ Directories apache:666
( So apache and devs can read/write, but not execute? )

PHP files not-apache:665
( so anybody can exec, but only devs can change? )

.htaccess files, and maybe JS and CSS? not-apache:664
( apache can only read, devs can change? )

Answer 1

The first one won't work - you need to be able to execute a directory to open it (that's what execute does in a unix directory).
I'd recommend adding different users to relevant groups (eg. developers) then giving "anybody" either no permissions or read only (so set the last part to 0). If you only have one relevant group, change the group of the folder to that group and set the permissions recursively to do what you need. Alternatively if you're on a RedHat based distro with acl enabled, look into setfacl - it allows you to give specific permissions on files/folders to users/groups. Two examples below:
setfacl -m user:john:r-x someFile.php
setfacl -m user:michael:--- michael_mustnt_read.txt
setfacl -R -m group:devs:rwx scripts/ - allow the devs full permissions inside this directory.
setfacl -d -R -m group:devs:rwx scripts/ - same as above but doesn't make any changes to existing files, sets the permissions by default on new files.