Question

After an install / setup of Magento on a LAMP Server, what files should be left writable, readable, and/or executable (by owner, group, public)?

What is optimal for a secure magento server?

Answer 1

All folders should be 775
All files should be 664.

Now the exceptions:
/var should be writable for everyone (777)
/media folder should allow web to write in it.

You can run those if you have SSH access:

find . -type d -exec chmod 775 {} \;
find . -type f -exec chmod 664 {} \;

Atleast that is what Magento Wiki suggest.