I have an Ubuntu 16.04.1 with Apache 2.4.23, PHP 7.1 RC3, FastCGI, PHP-FPM with separate pools for every site, MariaDB, PhpMyAdmin, Webmin and Nginx as a reverse proxy because I have to install Varnish and all my sites are SSL. I've also installed WordPress. Everything is last version and is working fine.
Security wise, every site is working with a separate user owner through PHP-FPM pools, and everything is owned as
user2:www-data, etc. Every site is in
As I said, everything seems to be just fine, and the last thing I'm working on is good security in WordPress:
Everything has the setgid bit enabled.
wp-contentand every sub-directory are 2730 and all files are 2640 so that user gets total control,
www-datagroup can enter folders and others can't do anything.
uploadsare also 2730.
- Every other directory and subdirectory is 2710, and files are 2640.
.htaccesis 0660 and when I'm done with it, it will be 0640.
As said, everything works fine and I'm able to update, install/delete plugins and themes, etc.
BUT I'm having problems with
wp-config.php. I can set it to 644 or even 404, but when I set it to 640 -or 400, which is what I would like-, I get the white screen of death.
I've checked that the file is owned by
Does anybody know why it needs the read bit for others?
Thanks in advance.