RE: Apache+PHP+ftp security

> -----Original Message-----
> From: abend [mailto:[email protected]] 
> Sent: Saturday, 26 March 2005 4:55 AM
> To: [email protected]
> Subject: Apache+PHP+ftp security
> 
> Hi all,
> 
> I'm configuring a linux server which may act as our main hosting
> server. This is, we provide hosting services for small business, and
> we need to configure our linux server to host their web pages. Our
> clients will upload their files by ftp (now it's vsftpd).
> 
> Our first purpose was setting the ftp server to upload the files to be
> owned by the user which logged in and by group www-data (the files for
> each virtual server is under /home/example/www, where example stands
> for an example user), and umask set to 027. Our requirement is that
> the user example does not belong to the www-data group. By this way we
> get no problems about users reading another user php code, etc, but we

You may be able to solve the permissions problems by using ACLs on the
filesystem.

I'm not sure i fully understand your setup, but i'm guessing that if the
/home/ directory had an ACL that gave www-data read permission and to
inherit read permissions on all folders and files created, the end user
would not need to be a member of the www-data group BUT files created
would be readable by www-data.