Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Your expert experience and assistance is great, greatly appreciated here.

I have been running a LAMP server for a long time, yet I still struggle with the best way to set file & directory permissions for FTP and WWW protocol activity.

My Control panel is WHM/cPanel (not that it makes a difference), and out-of-the box:

  • files are owned by the user account setup in WHM (eg, "abc")
  • files have a group setting of "abc" as well
  • file permissions are created with 644
  • directories are owned by "abc"
  • directories have a group setting of "abc"
  • directories permissions are created with 0755

Again, these are the default permission settings.

Now everything is fine with FTP activity, but please advise me if any of these file/directory settings create issues, especially with security.

Here's where my struggle comes into play. I have PHP apps that allow a visitor to create, edit, rename, delete, etc. sub-directories and files in certain selected directories. PHP runs as "nobody" on my server.

So in order to get my PHP/Web apps to work, I have had to:

chown nobody *
chgrp nobody *
chmod 0777 *

to everything in these certain & selected sub-directories.

I know this is probably a huge security whole (so don't ask me for any links :) but how should I set all the permissions to allow my FTP user to do his thing while allowing the PHP apps to do their thing will also "minimizing" any security risks and exposures? I know that big CMS systems like Drupal, Joomla, WordPress and so on, handle this.

Thanks ahead of time for reading through this and offering your expert advice!

share|improve this question
    
Perhaps something like suphp.org would help. –  Marc B Feb 11 '11 at 14:47
add comment

migrated from stackoverflow.com Feb 11 '11 at 14:49

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 1 down vote accepted

Check this posting from yesterday. It's a useful way to allow both FTP and Apache access to the same files, without either messing with groups or "777" files.

share|improve this answer
    
Ok, thanks "Coops". I read through the post & thread, especially your comments on unix ACLs. Hmm, I am a PHP developer that does some very high level stuff on my server to make things work -- permissions wise. In other words, I am a bit lost on what to do and how to do what you are proposing (although I really like the notion because I don't want to add another layer or piece of software -- suPHP -- that could do some of the things stating in the thread, if I don't have too. –  H. Ferrence Feb 11 '11 at 15:21
    
Does anyone know of a good "user-friendly" and non-technical tutorial on Unix ACL? –  H. Ferrence Feb 11 '11 at 15:27
    
Have you logged in to the command line with SSH at all? To start adjusting permissions it's were you need to be really. The two commands in my post are literally all that is needed. –  Coops Feb 11 '11 at 19:11
    
@Coops...yes I logged in via PuTTY (which I do very often). I had to ask my SysAdmin to install ACL - which they have done. I ran a GETFACL and it worked so I truly believe I have all the tools I need to help me with my objective. So now, what do I do (ie., how do I use the SETFACL command) to achieve my objective? –  H. Ferrence Feb 12 '11 at 13:17
    
Further, how should I best undo the -rwxrwxrwx nobody nobody on all my files and dwxrwxrwx nobody nobody on all my directories and make it so that both my FTP user "abc" and my web app can share the dirs/files without leaving the security doors wide open? –  H. Ferrence Feb 12 '11 at 13:24
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.