[wp-hackers] File management permission/owner best practices

[Philip Walton]

> In such a case, many shared servers use a method called "setuid" or
> similar. Essentially, this is a modified way to run PHP such that,
> when the webserver process calls the PHP executable, a script or other
> code changes the user id of the running process to be the same as the
> owner of the PHP script. So instead of PHP running as "www-data", it
> runs my files as "otto". This has two effects: a) anybody hacking into
> my website gets my credentials, but that protects other users of the
> machine (since I won't have access outside my directories) and it
> eliminates the need for sites to run with open permissions schemes
> like 777 and such and b) if the process creates a file, it creates it
> with my user id, thus allowing the direct upgrade method to work and
> eliminating my need to input FTP credentials.
>
> The bottom line is that you shouldn't be changing file ownership in
> order to use the direct upgrade method at all. That will always lead
> to poorer security. If you're on a testing machine or just totally
> unconcerned about security issues, you can pre-define the FTP
> credentials by using defines in your wp-config.php file. Use FTP_HOST,
> FTP_USER, and FTP_PASS. If you are using ftp over ssh, you can also
> define FTP_SSH, FTP_PUBKEY and FTP_PRIKEY as needed. For ftp over ssl,
> define FTP_SSL. You can find all these in wp-admin/includes/file.php.
>
> -Otto

Thanks Otto, that's very helpful. I'll look into the setuid process as 
it sounds exactly like what I'm wanting to do.