Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to know if there's a way to set file permissions on my apache server so that the files can be served up by apache, but cannot be read or accessed by select users. Basically, I'm trying to figure out whether it's possible to "black-box" parts of my project's PHP code base from hired consultants.

share|improve this question

migrated from Mar 30 '10 at 16:09

This question came from our site for professional and enthusiast programmers.

remove them? will the consultants be editing the files in production? can you use subversion as a versioning system? – gr33d Mar 30 '10 at 9:31
Please clarify, what are yu talking about: the files or the urls? – Col. Shrapnel Mar 30 '10 at 9:32
@Shrapnel, it seems clear he is worried about his "PHP code base", so files. – Kris Mar 30 '10 at 9:33
Yeah i see it now. So, it is not apache issue at all – Col. Shrapnel Mar 30 '10 at 9:38
Yes, my boss is concerned with the PHP code base, so I'm talking about restricting a contractor's read access to specific files. – Jerome May 26 '10 at 8:26

Apache will access the files as a specific OS user, usually named "www-data" or similar, belonging to a specific OS group (usualy "www-data" or similar).

If the other users are accessing the files through the web server, you need some access control on a level above the OS one (say, application level). For example, you could implement a trivial access control in php.

If what you want is preventing other OS users to directly access the files on the file system (not passing through the web server), you could simply give read permission to an OS group to that set of files and add/remove OS users to that group, according to your needs.

NOTE: I've just interpreted your question, cause it was not extremely clear to me. Maybe you could clarify a bit, to get more appropriate answers.

share|improve this answer

Have the consultants work in a development environment and handle deployment to your production environment yourself when they deliver code ready to go live.

Any other approach will have at least some potential for the consultants to gain access to code that you don't want them to have access to.

share|improve this answer

If you want to protect parts of your application from prying eyes then you should probably consider using a PHP encoder (IonCube and Zend Guard are popular choices). Please not that these require you to install a decoder extension, so if you're on shared hosting make sure you contact your hosting provider to see if this is a viable solution for you.

share|improve this answer

Yes - this is trivial.

Set up a group for the people who should have permission to read the files and include the user your webserver runs as then set your file permissions as rw-r---- (0640) Note that there's no way to prevent PHP scripts written by the baddies from reading the files though.


share|improve this answer

It depends on underlying operating system, on Unix this kind of restrictions is totally possible.

If you don't want trust them enough to read the code a better way imho is to :

  1. Restrict access to whole apache server, especially if it's a production environment
  2. Make them use SVN or other versionning software and fetch their code remotely from your server
  3. Implement a service-oriented architecture, this kind of design can be good to black-box some part. As long as a service is clearly documented and works as expected there is no need to see underlying code to develop with it.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.