I'm on my first time setting up an Apache2/Ubuntu web server and I'm stuck as to how to achieve the security settings I need.On the www folder - the web root - my www-data group (the apache and PHP account) needs to have limited permissions to prevent any scripts running under Apache from modifying or deleting files without explicit permission. However, users who connect using WinSCP or similar to transfer their files into the www folder need to have full permissions so that they can copy files into the web root and remove old files etc.Ideally, I would seem to need one group - www-data - with limited permissions for the webserver to operate under and one group - say webdevelopers to contain any people working on web projects - with full permissions on the www folder.Those of you who set up web servers regularly - can you help by advising me how you secure your web root correctly while allowing developers to add and remove files as they need?
Securing www directory in Ubuntu/Apache without restricting access to those who need it?
apache httpd;users