I have some static files that I would like to serve via Apache to a website which uses basic authentication to restrict access. In addition, I want to be able to prevent people with login accounts on the web server from accessing these files.
What's the best way to achieve this? The simplest thing would be to have the restricted files owned by the web server account ("apache", in my case, as I'm running on Fedora). However, this thread suggests that allowing the web server user to own anything in the www root is a bad idea from a security perspective:
As a general rule, no mechanism should exist that might theoretically allow your apache server to write to anything on your system, unless there is simply no other way of achieving a particular effect you happen to want.
The most effective ways of ensuring this include... [n]ot doing anything silly ... eg allowing your web server user to own anything in the www root.