Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like some help understanding web-server directory permissions. Apache, CentOS, PHP, Mysql

Example, I have multiple sites in /var/www/html They are in paths like: /var/www/html/www_domainname_com

inside each site I might have a path like /lib/mysql/ like PHP connect stuff, database config, etc.

What should me permissions be so that someone cannot just browse to that directory? Should I just .htaccess them?

I have apache:apache as the owner of all my web directories.

Can I prevent someone from crawling certain directories of my web-server? I have a robots.txt, but what is to say the crawler obeys it?

So to sum up: 1. What is the best owner/permission set for my sensitive files that the web-server or php or mysql needs, but I dont want people browsing to?

  1. Can I prevent straight out crawling of portions?
share|improve this question


What you want to do is impose an open_basedir directive for each site. You specify a directory and therefore no PHP script will be able to crawl out of that directory.

This means that you need a specific directive per website so either you set the aforementioned directive via a .htaccess or via a per-site php.ini.

To implement the last option, you will need suPHP or something similar.

share|improve this answer

While Antoine Benkemoun's answer address the specific points you raised (which have been asked and answered many times before, e.g. here), its a very bad idea to have all the directories/files writeable by the same uid the webserver runs as.

A fairly generic solution I would recommend is having a seperate directory in each vhost which is writeable by the webserver (but with PHP/CGI functionality disabled) and everywhere else having all files readable by all (including webserver) and writeable by owner and group - and have all the users who should be able to update a file in the relevant group (you might want to set up a group per vhost) and have the sticky group bit set on directories.

Note that this is not a replacement for the per-vhost open_basedir option.

You should also set a default session save path and include path on a per vhost basis (this needs to be writeable by the webserver uid).


share|improve this answer

Instead of fiddling with the permissions of these folders, you can consider placing these files OUTSIDE of your web-accessible folders. After all (as you say), nobody has to open those. So place them one level ABOVE your web-directory (if you have access to this), and that way you prevent that web-users can browse these files for sure.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.