Force owner of all files in the folder “/var/www” are user www-data

Question

I have a dedicated server, installed with Debian, Apache and PHP installed using "sudo apt-get install php5 php5-curl" command.

You can force all created files in folder and sub​​-directories are always user www-data?

If I log into sftp and I send it to a file on FTP, it is always as root, because I'm logged in as root, it is also possible to change, for example, I want to send the file to the server logged in as root but it is his owner www-data?

Answer 1

Having all files under www-data being owned by the web server - assuming write permissions by default - is dangerous, as a bug in a script or the web server itself could lead to source code injection.

The files under /var/www shouldn't be owned by the web server unless a certain web application really needs write access to a folder.

Even then and especially in a shared hosting environment there are better solutions than making the web server owner of such directories because this would allow every other PHP script - started by the web server - to write into that directory.