dumb question about users and permissions.

There are several ways to do it, my favorite is to make all the files owned by their respective users and chmod each user's home directory to 750 (owner read-write, group read-only, and others nothing). Then I setgid all those directories to the Apache group. That way, all new files will be created with the appropriate user as the owner and Apache as the group. Each user can do whatever he wants with his own files, Apache can read all of them, but no user can even see another user's files.

With this setup your PHP scripts (assuming you're using the standard mod_php; please ignore if all your sites are static) will only be able to read from the disk, but not write or create new files. If your users have PHP scripts that need to write to the disk, you should either tell your users to chmod the appropriate files to 660/770 or use a special Apache module such as suexec or suphp.

Don't use 775 or 777 or anything of the sort unless you trust all of your users not to hack each other's sites. The last digit MUST be zero or your users will be able to view each other's files. All the popular CMS's store their DB credentials in plain text! Sure, FTP gives you a chroot, but what about PHP scripts? Sure, safemode and openbasedir can help, but those are stopgap measures and some of them will disappear in the next version. Nothing beats native UNIX permissions.

Ok great that sounds like a plan I will proceed with that. I really only have two people logging in through FTP so I am not too worried about people modifying files but you do make a good point. I will go ahead and proceed because your setup looks like what I need anyway. Thanks for the heads up!

Sorry, I left out an important detail. Chmod'ing to 770 won't do. If you want real security you NEED suexec/suphp. Otherwise the PHP scripts will run as Apache and be able to read everything, as well as write to any directory with 770 perms.

Clever users can bypass open_basedir restrictions:

This is banned

$data = file_get_contents('/path/to/another/users/file');

But this isn't

$data = shell_exec('cat /path/to/another/users/file');

This, of course, can be banned using safe_mode configuration, but who knows if there's another hole, PHP being what it is.

I tried it out and it looks good! Thanks for the help. I set up all directories as 750 and well there are only two people that access these files so I am not too worried about the php scripts since I am the one who writes them…