What are the recommended directory ownership & permissions for hosted websites?

Question

So, I'm not sure what are the recommended directory ownership and premissions for directories of my websites.

└── var
    └── www
        ├── website1
        │   └── public_html
        └── website2
            └── public_html

So the owner of var and www is already root:root.

└── [root     root    ]  var
    └── [root     root    ]  www
        ├── [user1     user1    ]  website1
        │   └── [user1     user1    ]  public_html
        └── [user2     user2    ]  website2
            └── [user2     user2    ]  public_html

It should be like above?

Or:

└── [root     root    ]  var
    └── [root     root    ]  www
        ├── [root     root    ]  website1
        │   └── [user1     user1    ]  public_html
        └── [root     root    ]  website2
            └── [user2     user2    ]  public_html

For premissions i did like this:

└── [drwxr-xr-x]  var
    └── [drwx--x--x]  www
        ├── [drwxr-xr--]  website1
        │   └── [drwxr-xr-x]  public_html
        └── [drwxr-xr--]  website2
            └── [drwxr-xr-x]  public_html

For better orientation:

var 0755
www 0711
website1 0754
public_html 0754 or 0755

Any suggestion?

Answer 1

Giving the information you have provided:

I would always suggest that the user for your web application is www-data:www-data and the file permissions be NO HIGHER than 755.

if you are creating split hosting then yes of course you can user different users, www-data is just a common user to use, though set up correctly you can user basic users. never use root. if you need special privileges give your user specific powers (sudoers), not let that user have all the power.

With anything below your document root, in this case this would include your www folder (unless you have web assets stored there), I would keep the file permissions to another user, I would always advise against root but it wouldn't be so bad at this level.

You need to remember anything executed as root is dangerous regardless if you think you server is safe. your server isn't safe.

My tip is to keep root out of the picture as much as possible. I hope this helps.