I'm not sure what details are relevant, but here is some general context. I'm configuring a Ubuntu 12.04 web server on AWS to process customer payment info before redirecting them to a hosted pay-page, which will not return transaction details for further processing. Pre hosted pay-page processing will involve connecting remotely to our on-premise database so customer info can be verified and account details can be returned for display.
I'm the only one administering the server. The default permissions appear to be 755 for most directories and files, with owners being root:root. In trying to follow the security principle of least privilege, I'm wondering about removing all world read/execute permissions so the Server Root is left with 750, adding myself to the root group to retain usability. I have Apache running as www-data, and I've set permissions for the Web Root to 2750 and owners to root:www-data -- adding myself to the www-data group for usability.
It seems common to change a systems umask from a default of 022 to 027 so anything new created has permissions 750 instead of 755, but I haven't come across anything that talks about making that sort of change "retroactive" for the entire file system. Is this a good idea, and is there a proper way to do it?