0

I have several websites under /home/user/www/, since I've had to restore all www directory from a backup, most of the files are with root ownership and permissions. Looks something like this:

drwxr-xr-x 34 root     root     4.0K 2009-09-10 14:04 .
-rw-r--r--  1 root     root      127 2009-09-10 10:13 file1
-rwxr-xr-x  1 root     root       23 2009-09-10 10:12 file2
drwxr-xr-x  4 user     user     4.0K 2009-09-10 10:05 ..
drwxr-xr-x 14 root     root     4.0K 2009-09-08 12:08 folder

My question is, how safe is having them like this? should I change permissions/ownerships to all of them (www-data). I'm the only one who edit those files.

Improve this question

2 Answers 2

Reset to default
2

If you're the person who edits those files, change them to the user you edit with (conventional wisdom would hope that this user isn't root)

If any processes need to write to any files or directories, make sure there is appropiate ownership and permissions on them.

It's that simple.

Improve this answer
1
  • 1
    +1 true... just don't make the files writable by www-data (unless they need to be changed by the web server, of course).
    – David Z
    Sep 11, 2009 at 0:14
0

I like to own them to the user that will edit them, and make them group readable by the Apache user, remove all rights to other users.

Definitly do NOT make them owned by www-data (or writable by www-data), as the web-server (and by implication anything that runs along with the webserver - such as the php interpreter) can then overwrite them.

Improve this answer

You must log in to answer this question.