I have setup an instance of apache server(on ubuntu 12.04) and hosting two php websites on it. Websites are maintained by different teams and they don’t want the code to be visible to the other team.
The code for websites is present in directories /etc/sites/team1 and /etc/sites/team2. Both teams have FTP access to server (using vsftpd). The webserver is running with user www-data’ s credentials which belongs to www-data group. This means all the files that are present in the sites directory must have read permission for user www-data or group www-data. When users upload the file through FTP client, the file’s owner and group are set to user and group of FTP user.
How an I set the default group of each uploaded through FTP server to www-data?
One way is to set FTP user’s default group to www-data, but in that case FTP users of both sites will have group www-data and each file has atleast read permission for this group they will be able to see each other’s code.
What would be the correct way to protect source code so that both are accessible to apache server but not the other team?
One quick solution for me is to have separate users groups for each website.