Lighttpd

does a umask before lighttpd help? which might affect any fastcgi umask, unless you start fastcgi with umask reset.

A commonly applicable solution is provided below, without need to modify lighttpd.

1. Create a group, e.g.'lighound', and add 'lighttpd' and 'pound' users as members. This will be a supplemental group for each of them.
2. Create a subdirectory (in the location under which you want sockets created)
   

   mkdir sockets-lighound && chgrp lighound sockets-lighound && chmod 2750 sockets-lighound
   

3. Set 'umask 002' before starting lighttpd and understand the security implications of doing so on your system. If you're on a system with user-private groups, or at least on which no other user is a member of 'lighttpd' primary group, then this is probably a reasonable action.

When lighttpd starts up, it will create a socket in the directory and the g+s permission on the directory will make the socket ownership lighttpd:lighound, and the umask setting 002 (set before starting lighttpd) will make the permissions on the socket writable by both user and group. Due to the permissions on the 'sockets-lighound/' directory, only the lighttpd user and members of the lighound group (lighttpd and pound) will be able to access the socket, and only the lighttpd user will be able to create or remove sockets from the 'sockets-lighound/' directory.