Proper and Best ACL Settings for Shared Access and Good Security

Question

I have ACL installed on my server. I maintain my web documents and PHP scripts via FTP. Some of my PHP Web Apps are designed to create/update/delete web documents and do file uploads.

Can anyone advise me on the correct SETFACL settings for my files and directories to enable me to FTP while enabling my PHP apps to perform as described above while not exposing my server to security weaknesses.

Currently, I have certain directory and file permissions set to 0777 with owner/group as "nobody".

Thank you very much for helping me out.

Answer 1

There's an example of something I use in an answer posted at oddities in interference of linux extened ACLs and 'regular' permissions, copied here for ease of reference:

chown --recursive $username:$userrole /home/data/private/$datadir
chmod --recursive u=rwx,g=,o= /home/data/private/$datadir

# remove previous ACLs
setfacl --recursive --remove-all /home/data/private/$datadir

# User/group access for owner, group leader and web server
setfacl --recursive -m u:$username:rwx /home/data/private/$datadir
setfacl --recursive -m g:RGLeader:rx /home/data/private/$datadir
setfacl --recursive -m u:www-data:rwx /home/data/private/$datadir

# Copy access modes to default access modes
getfacl --access /home/data/private/$datadir | setfacl --recursive -d -M- /home/data/private/$datadir