1

I am using php on Linux / Apache server. I have Three type of directories like as

|_ Writeale Directory
|_ PHP Files 
|_ Image Files

Writeable Directory would used only by PHP to writing some txt, images... PHP Files excuted by server and return HTML codes Image Files Directories contains only images like as jpeg gif swf ....

Which permisions needed for each directory? What is default permission for directory (created by FTP or PHP)? My server Default value is 755. Is it secure?

Has permissions any effect on server performance?

3 Answers 3

1

A very general overview:

  • directories where users (i.e. PHP) can write data should lie outside your httpd documentroot.
  • directories that hold content apache should read require world read access, and not much else, i.e. 0755 is more than sufficient.
    Directories require eXecute access; files should NOT have execute permissions.
    No, not PHP files either.
  • The default permissions are determined by the umask set for the user apache runs as.
  • uploaded files should be examined and verified before being made available for download.

Depending on the country you are in, you can be liable if you allow people to upload viruses and distribute them for download.

1

You can't design a security model without knowing both what objects should have controlled access and what users require what access. But you've made no mention of how (and more importantly by whom) the files are deployed/updated. Nor have you given any indication of what the ownership of the files/directories is - in the absence of this '0755' is totally meaningless.

Implicitly, all the files must be readable by the webserver uid if PHP is running as the webserver uid. But there are other ways of controlling the interaction between PHP scripts and files (suPHP, safe_mode).

Which permisions needed for each directory?

The right ones - not possible to be more specific.

What is default permission for directory (created by FTP or PHP)?

It depends how you configured PHP, FTP, your operating system and the permissions control system.

My server Default value is 755. Is it secure?

Probably not. Allowing executable files within your document root is dangerous. So is allowing direct access to (user-) uploaded files.

2
  • file uploading by PHP need admin login. Then only admins would upload contents like jpgi gif..
    – Huseyin
    Nov 29, 2011 at 9:24
  • You would like to think so...?
    – symcbean
    Nov 29, 2011 at 9:29
0

First, permissions have any effects on performance. To be more precise, the permissions are checked every time, what they could be defined, without performance limitations. You should put the most restrictive permissions you can for security reasons. If your web server access to your files with your account, change your dir access to 700. If the web server access to your files with a www-data user, you can change the group or the other to access. You don't give us the information, but the web-server need to write in these dirs ? Or just reading ?

The default permissions are defined by the umask parameter in your shell, your FTP server or in your PHP.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .