Alternative to having directories with 777 permissions

Question

I am running several websites on my dedicated server and a lot of my sites require that some directories have permissions set to 777. I know this is a major security issue, and I also know it's possible to configure things so you don't have to use 777 on directories, I just don't know to do it. Can someone point me in the right direction so I can stuff function without having 777 directories?

Thanks!

Answer 1

When I discovered unix ACLs a few years ago they amazed me! It is also amazing how they aren't common knowledge.

In short they allow you to set extended file permission, beyond that of simple user+group+other classically documented.

The two commands you want are "setfacl" and "getfacl". You may need to remount your fs with acl support if it complains "mount -o remount,rw,acl /".

The two common ways I use setfacl are:

setfacl -R -m u:apache:rwx /var/www/mydirectory
setfacl -R -d -m u:apache:rwx /var/www/mydirectory

The first line recursivley added rwx permissions to everything in the given path (on top of the permissions already in place). The second command makes the default policy for new files and directories to automatically have rwx for the apache user.

This is sooo much quicker than messing with suPHP or group permissions etc.

Answer 2

Since you're in control of the server, you might consider running PHP through suPHP. The PHP processes are spawned for a distinct user. That way your directories can be chmodded to 0700 with ownership to the user the processes are running under.

P.S.: See you on serverfault. I voted to move.

Answer 3

If you have to run with things set to 777, it means you have some ownership problems.

Generally speaking there are only three groups of users you have to worry about:

• the actual users who are setting the web application up;
• the uid that the web server (and probably PHP) runs under; and
• everyone else.

Usually you should be able to set the ownerships of the files and directories to be the actual user doing the setup, and the group membership to be the group membership of the web server. If you do that, then you can set the permissions on most things to be rwx for the owner, and rx for the apache group; your application notes should be very specific as to what directories the application requires write-access. (If it isn't, it's probably written loosely in other ways too and may be a security vulnerability.)

If you do it correctly, then "everyone else" (which is "everyone as users on the server who are not members of the web server's group") can have their permissions set to 0 (ie no-read, no-write, no-ex).

For example, my WordPress installation is installed by me, but run by the webserver, so everything is generally permission 750, ownership dave:apache. The directory where wordpress stashes incoming uploads is set for permission 770, ownership dave:apache.

Answer 4

Always use suPHP (or suexec if you're not using PHP). Having the scripts run as the user is almost always better than having them run as the web server.