[Sussex] Creation rights

[Paul Graydon]

I've got an RHEL3 box sitting at work that is being prepped for live
work, primarily as a webserver for both internet and intranet, aiming to
shift it away from an older box we want to retire.
Everything seems to be working fine, Apache and MySQl run without any
problems, got two virtual sites being hosted happily.  For security
purposes I've taken root's FTP login rights away, and have allowed two
accounts remote ftp access (mine and my boss's), while we both know the
root login details if they're needed.  I'm trying to keep our two
accounts with the minimum access rights needed.  When you create an
account in RHEL it seems to make them without any groups assigned to
them.  As I'm only intending the FTP accounts to be used for uploading
web files (all other work would be done over Putty or at the server
itself) and manipulating the htdocs area, I added both accounts to the
apache group.  Apache group was owns the htdocs and subdirectories, but
neither account seems to be able to create folders at all.  What sort
other groups am I likely to need to put them in?

Linux security isn't something I've had time to dig into before, so I'm
a bit of a n00b when it comes to it.