Giving Ownership/Rights properly on Ubuntu/Linux

Question 1

Just a note when giving permission for web server.

Permissions are simple. You just have to remember there is read write and execute permission in *nix. You won't need the execute permission in any of the script files but all folders must have execute permission. That leaves you with the read and write permissions. You will need read permission for all the files and folders. You will only need write permission only to the folders and files which need to be changed by the web server. Basically you will need read write and execute permissions for temp folder, and if you are using file upload then the folder where you store the files. You may need to have write permission only to files which needs to be changed by the web server (for simple sites these may not be there).

Question 2

You should NEVER make a file executable (bit 0 set) that is not an executable shell script (CGI scripts such as PHP do NOT need execute permission), setting it to 777 is just plain lazy and dangerous from a security perspective.

I often run the following to correct permissions on a web folder:

chown username:groupname * -R
find -type d -exec chmod 755 {} \;
find -type f -exec chmod 644 {} \;

This will give all directories:

read permission by the owner, the group and anyone else
write permission by the owner only
execute permission which allows entering them and listing of their contents.

And it will give all files:

read permission by the owner, the group and anyone else.
write permission by the owner only.
no execute permissions at all.

If you can add the Apache/HTTP server user to the user's group (usermod -G apache -a username), you can tighten this even further to 750 and 640 which will prevent other users from being able to read the web files (this can be bypassed via the webserver though depending on the server configuration).