1

I would like to know if there's a way to set file permissions on my apache server so that the files can be served up by apache, but cannot be read or accessed by select users. Basically, I'm trying to figure out whether it's possible to "black-box" parts of my project's PHP code base from hired consultants.

5
  • remove them? will the consultants be editing the files in production? can you use subversion as a versioning system?
    – David Fox
    Mar 30, 2010 at 9:31
  • Please clarify, what are yu talking about: the files or the urls? Mar 30, 2010 at 9:32
  • @Shrapnel, it seems clear he is worried about his "PHP code base", so files.
    – Kris
    Mar 30, 2010 at 9:33
  • 1
    Yeah i see it now. So, it is not apache issue at all Mar 30, 2010 at 9:38
  • Yes, my boss is concerned with the PHP code base, so I'm talking about restricting a contractor's read access to specific files.
    – Jerome
    May 26, 2010 at 8:26

5 Answers 5

1

Apache will access the files as a specific OS user, usually named "www-data" or similar, belonging to a specific OS group (usualy "www-data" or similar).

If the other users are accessing the files through the web server, you need some access control on a level above the OS one (say, application level). For example, you could implement a trivial access control in php.

If what you want is preventing other OS users to directly access the files on the file system (not passing through the web server), you could simply give read permission to an OS group to that set of files and add/remove OS users to that group, according to your needs.

NOTE: I've just interpreted your question, cause it was not extremely clear to me. Maybe you could clarify a bit, to get more appropriate answers.

0

Have the consultants work in a development environment and handle deployment to your production environment yourself when they deliver code ready to go live.

Any other approach will have at least some potential for the consultants to gain access to code that you don't want them to have access to.

0

If you want to protect parts of your application from prying eyes then you should probably consider using a PHP encoder (IonCube and Zend Guard are popular choices). Please not that these require you to install a decoder extension, so if you're on shared hosting make sure you contact your hosting provider to see if this is a viable solution for you.

0

Yes - this is trivial.

Set up a group for the people who should have permission to read the files and include the user your webserver runs as then set your file permissions as rw-r---- (0640) Note that there's no way to prevent PHP scripts written by the baddies from reading the files though.

C.

0

It depends on underlying operating system, on Unix this kind of restrictions is totally possible.

If you don't want trust them enough to read the code a better way imho is to :

  1. Restrict access to whole apache server, especially if it's a production environment
  2. Make them use SVN or other versionning software and fetch their code remotely from your server
  3. Implement a service-oriented architecture, this kind of design can be good to black-box some part. As long as a service is clearly documented and works as expected there is no need to see underlying code to develop with it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .