Security of web app files and database passwords in a linux shared hosting environment

Question

I have a web app on a linux shared hosting machine. Lets say I have a .htpasswd file, some configs that store a database password and generally don't want people snooping through my source code looking for vulnerabilities.

The webserver (apache) needs read access (and write in some cases) to the above files. However I don't want other people on the same shared host to have access.

I've never quite understood how this is supposed to work. The question here is similar but seems to point more at stopping the web app from hosting a passwords file accidentally.

AFAIK, all I have to work with is basic linux permissions. On one server, I'm expected to give "others" permissions for apache. Then removing the group permissions, that all other users are in, denies them access. This seems pretty roundabout. On another server there's a nobody group set on public_html with only group permissions set.

One concern is that if the apache user has access to my files, a simple script could be written and executed to gain access by another user:

<?php
header("Content-Type: text/plain");
include $_GET['f'];
?>

TLDR: I need apache to have access to the source files and passwords, but not other users on the same machine (excepting admins ofc).

What is a common setup?

Related questions:

• How to allow apache access to a file but prevent others from viewing it?
• https://unix.stackexchange.com/questions/30879/what-user-should-apache-and-php-be-running-as-what-permissions-should-var-www
• https://askubuntu.com/questions/26848/permissions-issue-how-can-apache-access-files-in-my-home-directory

Answer 1

Create a group, add apache/www-data to the group. Then:

chown -R apache:groupname /var/www/mywebapp/ && \ chmod -R 640 /var/www/mywebapp

This will grant the owner read and write (6), and the group read (4) permissions for the folder and all sub-directories and files. The apache user will be able to access the files, as will the owner, but others will not be able to. You should ensure they cannot su to the apache user.

Use Directory blocks in the vhost config to restrict access at the folder level. http://httpd.apache.org/docs/2.0/misc/security_tips.html #See Protect Server Files http://www.anchor.com.au/hosting/dedicated/Security_Hardening_of_an_Apache_Virtual_Host