I have one Linux LAMP webserver (Ubuntu) with some websites on it.
They all run within the same apache2 instance and are accessible by different vhosts.
Most of them are run by myself, but I also have some friends websites hosted there.
I want and use to have separate user accounts for different websites to manage files, cronjobs etc.
The webserver runs as www-data.
Now most of the files/directories don't require write permissions by the website, but some do. I am okay with separately setting those to writable with the user I use to manage the files. In fact i prefer it that way.
However what is always bugging me a little are files that are created by the webserver. For example cache or session files. Consequently they are owned by the web-servers user and with the default permissions are not writable by the users linux user. In my case file modifications by the web servers user happyn exclusively using PHP.
Now the "best" solution for that problem that I found would be running suexec/suphp to let the php process run as the owner of the PHP file. However this comes with the big trade off of not having the advantages of apaches mod-php and a big performance loss because every php process runs over cgi. But my biggest problem would be opcode and memory caching.
Now what I think I could do is to add all the users I have to the group www-data, so that with the default permissions of 664/775 the shell user can modify files. However the shell user will then not be able to adjust chmods because he/she is not the owner, but that should not be a problem as I cannot think of a situation where this would be necessary for files/directories created by the webserver. And the webserver as owner would not need it anyway.
However I am completely new to the whole group/user/permission stuff because I used to have my own server for every project and never did anything with shared hosting.
I only know structures from plesk/confixx and similar things and know that they are always problematic.
So I am asking for the easiest approach that handles common webhosting needs to that problem.
Furthermore: How can I efficiently "jail" the user to its own directory and have it look as the top-level directory in scp/ssh? I know that it will not be entirely possible and no security must rely on it (because the user could run a php script listing other directories etc...) but that is not the motivation. The motivation is to have everything a little isolated and seperated to facilitate management purposes.