I have a virtual Server with Ubunto 10.04 on. My host Mediatemple have a few guides on trying to secure the apache config, but I think they are missing some details, or at least it makes no sense to me. I have followed the guide on creating a web user and group but I can't seem to get the groups to be setup right and I don;t trust that they are secure.
I have read the question and answers on Securing a fresh Ubuntu server and have made some of the steps to securing my server. This includes setting up a new admin user and disabling root logon. I also would like to be able to sftp into my server (I user Transmit) and upload files to the websites directories but when I logon as my newly created web or new admin user it says I don't have permission to create or save files. I assume with the admin account I need sudo permissions (which I have setup already)
Currently my web directory structure is:
What users/groups/permissions do I need to setup and apply to the folders. Can I have it so new websites added to the www folder are running under the correct user automatically. I will be running django from the django folders so I assume I need the execute ability?
I also need to have it possible to upload files to the web folders. How can I setup a good way of doing this?