I have a server with Ubuntu with a web server (Apache or Nginx) running a PHP application. The application consists of the following parts:
- An executable code that handles HTTP requests (say in the
- A configuration (say the
- A file storage where the application puts its data (caches, uploads, etc; say in the
/var/www/demoapp/storagedirectory). The application writes files behalf the web server user with 644 mode (let's say I can't make the application write with another mode).
A deployment of the PHP application is made via SSH (the server is connected to) and consists of two stages:
- Upload the executable code to the server
- Run migrations. The migrations must be able to write the configuration file and the file storage. Running migrations means executing a shell command (e.g.
cd /var/www/demoapp/app && ./migrate.php).
What is the proper or the most common strategy of user/group accesses and file permissions for such application and deployment process? I expect an answer like «the web server should be run behalf user1, the SSH should be accessed via user2, the
/var/www/demoapp directory should have the xxx mode and so on».
Due to security concerns, I don't want the SSH deployment user to be able to run commands behalf root. And I don't want the web application to be able to write the executable and the configuration files (except when there is a migration running). I admit these requirements may be omitted keeping a good security level.