I'm working with a dedicated CentOS server where the base exposed webdirectory is /var/www/html
For security, who should own the html directory "root" or "apache"?
The perms are
drwxrwxr-x (are those optimal?)
The DocumentRoot should be owned by who will update it; don't make that root unless you want only root to do the updating. The apache user is nologin'd on CentOS by default, so it's also not the account you should be using to update the contents of the DocumentRoot. I typically leave the directory owned to apache, but grouped to a secondary group I set up for users who will have permission to modify the contents of the web root (
Root ownership will prevent apache from being able to make any changes to its DocRoot.
If you have just one site, you can get a lot of security by enabling selinux if its disabled. If you need access to network resources, its possible with selinux to say just mysql access, or just memcache access.