Co-authored by Elise Bauer and Arvind Satyanarayan.
Tutorial cross posted on Movalog and Learning Movable Type
The installation instructions in the Movable Type Install Guide contain a section in the Configuration area called Enable Security Features. These instructions tell you to uncomment the Umask lines in your mt.cfg if your server is running cgiwrap or suexec. If you don't know what CGIwrap or suEXEC are, you may be tempted to skip this step. Don't. This step gives your MT installation extra security, which we will explain. (Note that this tutorial is only appropriate for MT installations on Linux/Apache web servers.)
What is CGIWrap or suEXEC?
CGIWrap and suEXEC are features installed by your web host that give extra security to your files in a shared server, or "virtual host", environment. Most Movable Type weblogs are hosted at commercial web hosts who are able to give their customers affordable server space by hosting the files of several customers on a shared server. In a shared server environment, CGIWrap and suEXEC allow your cgi files to be executed with you as the account "owner". The cgi scripts can then create files with more restrictive permissions (644) that keep others from editing your files, yet still allow you to edit them. Without CGIWrap or suEXEC, cgi scripts create html files that need to have more relaxed permissions (666) so that the account owner can manage those files.

