php apache permissions - best practices [closed]

Question

I have a codeigniter application which creates folders using php. The owner of any folders created via php is 'apache', however if I want to upload a folder via ftp the owner is my ftp username.

I had an issue with php (apache) not being able to modify a file inside a folder that was uploaded via ftp because of permissions. In the meantime I have added my ftpuser to the apache group and apache to the ftpuser group but was wondering if there is a better way?

Answer 1

Generally what I do is chgrp any directory php will write to the group apache runs as (www on my server, could be apache on yours), chmod g+s . This will make any file created in that directory also owned by the web server group. If the default umask allows group write, this will solve your problem.

Answer 2

The best practice is to only allow users to read/write files that they should.

In my web-apps, I have a data directory for the website, which I store all my dynamically generated data from the app.

Then I only give permission for the app to write to that directory, and nothing else.