Wordpress, Apache, Changing File Permissions

[smpoole7]

My stats:

Code: Select all

/etc/redhat-release: CentOS Linux release 7.6.1810 (Core)
uname: 3.10.0-957.1.3.el7.x86_64 #1 SMP Thu Nov 29 14:49:43 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
httpd -v: Server version: Apache/2.4.6 (CentOS), Server built:   Nov  5 2018 01:47:09

Running a LAMP stack with several WordPress sites sharing the server. Each has its own /home directory. VirtualServers in httpd.conf and ssl.conf work like a champ. No problems there. We're using a single certificate with SAN and everything goes to the correct site. All good ... EXCEPT ...

We're not a giant ISP (this is a corporate server for about 15 different radio station Websites), so I know this can be done. Each /home directory (ex., /home/station1.com, /home/station2.com, etc.) may have a different maintainer. Joe might maintain station1, Tom might maintain station2, and so on. Joe logs in as "joe" and Tom logs in as "tom." All maintainers are members of the "apache" group, and that is their primary group.

The problem is, as changes are made, as people upload pages, and so on, the permissions get reset to owner-write-only. This shows up to our non-technical users as, they're in WordPress Control Panel and are unable to delete or update a plugin. I scan the logs, it shows permission errors, I run ...

Code: Select all

chown -r station_name:apache /public_html/wp-content/
chmod -R g+rw /public_html/wp-content/

... and everything is fine for a while. But then, a few weeks later, Joe goes on vacation and Tom logs in to make some changes to Joe's site, he can't delete or update files. I have to go in and do the "chown" and "chmod" thing.

I did some research a few months ago and figured out how to set the umask for Apache. That seems to be working: a test PHP script creates a file and it has owner and group rw set.

This has to be something simple. Maybe are users are using an FTP client to do uploads that insists on owner-write permissions? What could I look at? I really, REALLY don't want to do the cheezy, risky klong of just making the "wp-content" folder world-writable. I also want different maintainers to log in under their names. I don't want one master password and a single "master editing" user.

Thanks in advance for any suggestions.

[aks]

Here's a kludge:

Create a cron job that'll look for files not in the required state and change it. I guess you could even do it regardless what the ownerships where before (which may actually be dangerous, for example if somebody uploaded something bad, but it wouldn't work ('cause of permissions), the cron job would make it work).

Something like:
find <station_dir> -type f -mtime +1 -exec chown <user:group> {} \;

and run it (say) every 5 minutes.

Yeah it's a kludge, but would probably work.