I have a website which lays in some directory. Website has .htpasswd file for restricted acces and public_html folder where all files are. And I have index.php in public_html folder.
/var/www/site/ /var/www/site/.htpasswd /var/www/site/public_html /var/www/site/public_html/index.php
Apache is running under www-data user and apache is in www-data group.
The question is:
Which access rules would be the most secure. My assumption is that I should set the rules like following:
/var/www/site/ root:www-data 640(or 660 if we want to write logs also here) /var/www/site/.htpasswd root:www-data 640 /var/www/site/public_html root:www-data 740 /var/www/site/public_html/index.php 644 root:www-data
Am I Correct in my assumption?