Currently running a LAMP instance that developers are using for a variety of webapps. I have the following scenario:
- Multiple developers need access to create and modify files under /var/www/html
- The developers need to be able to access each other's code in case they are out on vacation, sick, etc.
My thoughts were the following:
- For each web application (directory) under /var/www/html, recursively change the owner to 'apache' and the group to a 'developers' group. Set the permissions at 570.
- For each file under /var/www/html, recursively change the owner to 'apache' and the group to a 'developers' group. Set the permissions at 470.
Keeping the files and directories as read-only to the Apache user is a good security practice, but is having such files owned by the Apache user a bad one? My concern was around what would happen if Apache got hit by a 0-day vulnerability or something of the sort.
If anyone has a more elegant way to do this, I'm interested in hearing it as well.