I'm running Ubuntu 16.
I have a public facing site, set up at /var/www/html/
There's some CMS software running, installed at /var/www/html/cms
The config files can be stored outside of web root for added security, so I have moved them to /var/www/config/
However, the CMS requires /var/www/config/ to have 777 permissions as it needs to write to it. (well, I think this is partly due to my user config ubuntu vs www-data, but 777 is the only permission which works).
The virtualhost setup has the DocumentRoot as /var/www/html/
In apache2.conf, I have:
<Directory /var/www/> Options FollowSymLinks AllowOverride None Require all granted Header always append X-Frame-Options SAMEORIGIN </Directory>
Now, my question... is this as secure as I think? I'm happy having the cms config files outside of DocumentRoot, BUT have had to give it 777 permissions and apache.conf does grant permissions to /var/www (even though there is not a virtualHost config pointing that low.
Should I be:
a) looking at fixing permissions/groups so the cms can run with 755 (or 775) permissions on the /var/www/config directory? b) amend the apache2.conf so it doesn't grant to /var/www/html (but rather just to /var/www/html)? c) happy and leave it as is?
Thanks in advance
By adding www-data to the ubuntu group:
usermod -a -G www-data ubuntu
I can then change the permissions of /var/www/config/ to 755 and the cms is happy with those permissions.
However I am not sure I want www-user to have the same permissions as the ubuntu user...
As a further note, the files and folders are all owned by ubuntu because this is the user (only user) who has SFTP access to deploy files. If I amended ownership to www-data, everytime something new is deployed, it'd revert back to ubuntu ownership.