I am managing one machine that hosts an OTRS webserver. It has a normal user, 'otrs', which runs several periodic tasks and keeps (in 'otrs' home) the needed files for the service to work. And then there is the Apache user, which runs the webserver that makes the app work. The 'otrs' user is in the 'apache' group, so I can give write grants to 'apache' in some folders.
To add some functionality, I need to give 'apache' write grants in the 'otrs' home directory. But, if I do it, ssh won't connect with authorized keys, because it's a security risk. I've tried using ACL's to give 'apache' write grants on 'otrs' home but not in home/.ssh, but it won't work.
So, what can I do? I've thought of removing the 'otrs' user and doing everything as 'apache', or run the webserver daemon as 'otrs' user, but I don't know how to do any of these, or if they may carry some problems...
Do you have any option that I haven't thought of?