My current setup includes nginx and php5-fpm. This question is about a host which contains a Wordpress site. The host has its own fpm pool with user:group, let's call it
wordpress:wordpress. Nginx runs using the default
This means that: PHP files are executed by
wordpress:wordpress, static files are served by
www-data:www-data. Therefore, all files need to be readable by both of those users. The files wordpress writes to should also be writable by
But here comes the problem: I want to allow modifying all the files via SFTP. Currently this is done using the
wordpress:wordpress user, which means this user needs full access to all the files.
Therefore, a malicious PHP script uploaded to the server can modify all files of this Wordpress installation and serve malware etc to the end users. I want to reduce this risk by making only the files Wordpress needs to write to writable by PHP.
I thought about setting up another user account, say
wordpress-sftp:wordpress solely for SFTP. This user's home folder would be the root of the wordpress host, just as
wordpress-sftp:wordpress would have full access to the files of this host. The files of the wordpress installation I would make readable by the
wordpress group. The files which need to be writable by wordpress I would make writable by the
wordpress group. Additionally I would add the
www-data user to the
wordpress group so that it can read the static files.
So all files could get permissions
640, the files which need to be writable by Wordpress would get permissions
Does this setup sound reasonable and secure? Or how would you solve the problem?