I've installed apache2-mpm-itk on a new VPS to run multiple sites on the same server with isolation following the directions here: http://www.webtatic.com/packages/httpd-itk/. I want to lock it down as much as possible but also need to be able to manage the files on each vhost as each vhost-user.
He recommends to set the webroot folder's owner and permissions like this:
chown owner-user:vhost-group /path/to/webroot chmod o-rwx /path/to/webroot ls -ald /path/to/webroot # drwxr-x--- 20 owner-user vhost-group 4096 Apr 5 19:38 /path/to/webroot
On my server I have root, a non-root user that is a sudoer, and the vhost-user for this site (who does not have sudo privileges).
Setting up the webroot with 755 permissions and then setting the owner to owner-user (I set it to my non-root sudoer user) means I can't modify the files and directories within the webroot as the vhost-user. (no group write permissions on the web root). The only thing I can think to do is give the vhost-user sudo privileges but that doesn't seem secure.
The article says that the owner-user is the owner of the webroot because:
The reason I didn’t change the user of the directory to vhost-user is that it would give the httpd process write access, which you still should take care of, as if there are vulnerabilities in the user’s code, the files could be hacked.
How can I set permissions/users etc. to be secure but still allow the vhost-user to manage their own home directory?
Also, within the webroot, how should I set the permissions of my PHP files and directories to keep them isolated from other users/groups on the same server?