Correct owner/group/permissions for Apache 2 site files/folders under Mac OS X?

Question

It's hard to find Mac-specific answers to this question on the web, so I'm hoping someone out there can put this one to rest for me? My permissions are screwed up on my sites and I'm not sure how to fix them without just slamming a recursive 777 on everything which is quite obviously incorrect.

Thanks!

Answer 1

This is the most restrictive and safest way I've found, as explained here for hypothetical ~/my/web/root/ directory for your web content:

• For each parent directory leading to your web root (e.g. ~/my, ~/my/web, ~/my/web/root):
  • chmod go-rwx DIR (nobody other than owner can access content)
  • chmod go+x DIR (to allow "users" including _www to "enter" the dir)
• sudo chgrp -R _www ~/my/web/root (all web content is now group _www)
• chmod -R go-rwx ~/my/web/root (nobody other than owner can access web content)
• chmod -R g+rx ~/my/web/root (all web content is now readable/executable/enterable by _www)

All other solutions leave files open to other local users (who are part of the "staff" group as well as obviously being in the "o"/others group). These users may then freely browse and access DB configurations, source code, or other sensitive details in your web config files and scripts if such are part of your content. If this is not an issue for you, then by all means go with one of the simpler solutions.