Converting server to allow Apache write access to certain directories, does this solution look right?

Question

I've been at this all day and think I finally figured it out, but want to make sure before I put it into production.

I'm changing my server to allow the apache:apache user write permission on a few directories. I'm the only user jeff:jeff on the server.

My directory structure looks something like this:

/home/jeff/www/                       0755 jeff:jeff
/home/jeff/www/example1.com/          0755 jeff:jeff
/home/jeff/www/example2.com/          0755 jeff:jeff
/home/jeff/www/example2.com/uploads/  0755 apache:apache

The problem is:

I run chmod apache:apache uploads/ to allow apache write access.

Whenever I want to edit a file in uploads/ via sftp, I have to chown it back to jeff:jeff, then reverse when I'm done.

My preliminary solution is:

• Add apache user to jeff group
• Give jeff group write permission on uploads/ dir via manual chmod 775
• Force apache user to create any new files + folders + subfolders as apache:jeff. Requires setgid 2775 on uploads/ dir
• Force apache user to create any new files + folders + subfolders with umask 002 = 775 via systemd

I'm only about 50% sure I've got all this right.

Does it sound okay? Is there a better way? Did I miss anything?

With Jim's help, here is the final solution I used:

For my reference.

# usermod --append --groups apache jeff

> Relogin all sessions

# chown -R apache:apache www/example.com/uploads/
# find www/example.com/uploads/ -type d -exec chmod 775 {} \;
# find www/example.com/uploads/ -type f -exec chmod 664 {} \;

# systemctl edit --full php.service

-----------
[Service]
UMask=0002
-----------

# systemctl daemon-reload
# systemctl restart php

WordPress users will want to add this to their wp-config.php:

define('FS_CHMOD_DIR', 0775);
define('FS_CHMOD_FILE', 0664);

Answer 1

Yes, that's the general idea, and you're fairly close, but I would suggest that rather than adding the apache user to the jeff group, it would be slightly more secure and perhaps a tad more convenient (and extensible, if that's important) to do it the other way 'round:

0. Take apache out of the jeff group.

1. Instead, add jeff to the apache group. For starters, this prevents apache from having read access to all the jeff group files.

2. chown the uploads/ directory to be apache:apache and chmod 775 so that anyone in the apache group can create/delete files there.

3. Have apache create files using umask 2 so that anything apache creates is group-writeable.

This way:

A) You no longer have to chown files before you can edit them; all the upload files are owned by group apache, are group-writable, and you already belong to the apache group.

B) You have the ability to easily add other users to the apache group and they, too, will be able to edit uploaded files.