I&#39;m setting up a shared web server running Apache.  Each web root will belong to a department, which has a corresponding Active Directory group to give access.  So far I&#39;ve got samba working and such, but am having some trouble wrapping my head around the necessary permissions to make all this work, especially securely.  So far I&#39;ve found that both the POSIX and the ACL permissions must both allow a user to write to directory which is proving problematic.  Is it better to give the web root directories very &quot;loose&quot; permissions and have Samba manage who can access the folders?<div>
<br></div><div>A few options I&#39;ve come across would have a user&#39;s logged in account mapped to the &quot;apache&quot; user through samba, using the &quot;force user&quot;, but that seems like a security risk allowing users to be apache.  Another option I currently have working is using a default ACL for apache to give the web server read of all the files.  The problem I have with this is some directories require write and some files should have read only (like db config files), so again a global permission set doesn&#39;t seem to work.</div>
<div><br></div><div>I&#39;d be very interested in knowing how someone has solved a problem like this.</div><div><br></div><div>Thanks</div><div>- Trey</div>