Ideal LAMP permissions and user?

[Murray]

Currently installing Processwire on an Ubuntu dev PC with a standard LAMP setup (incl MariaDB) with aim to use the like of Vultr or Linode for live.

The installer prompts for permission to /site/assets which has got me wondering; What is the ideal setup for a standard LAMP server on the likes of Vultr / Linode / Digital ocean? From a security standpoint should the site ideally be owned my the linux user, or by www-data? Or should it be www-data user owning writable folders and linux user owning the remainder?

I guess not being a linux guru I'm unclear on linux permissions and how they work with LAMP. Should I be chown-ing and chmod-ing different folders or is Processwire just fine and reasonably secure running as user:user as it seems to be after install?  

 

[teppo]

There are some pointers here, probably a good place to start from (if you haven't read it yet): https://processwire.com/docs/security/file-permissions/

Quote

Or should it be www-data user owning writable folders and linux user owning the remainder?

This is what I tend to do.