Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a typically configured LAMP server with various web apps running on it.

A few of the web apps require user supplied image upload functionality (as well as a couple WP blogs that need to upload images).

I have tried to tighten my permission security, and I am finding that 767 is the best I can have on my /uploads/ directory.

I've read that 755 or 750 are the best for directories, but my uploads won't take when set with them.

So my question: is 767 safe? Or should I take the time to get under the hood and try to get 755 or 750 working somehow?

share|improve this question
    
Please add this info to your question: user and group of the directories. –  jftuga May 26 '11 at 19:42
add comment

1 Answer 1

up vote 0 down vote accepted

If you are allowing uploads into a directory wherein files can be executed, you're asking for trouble. 666 would be far more appropriate. Root doesn't need to be executing things in an upload directory. No one needs to be executing anything in that directory. For my money, I'd do 262.

You literally cannot have too much security on a directory that contains user uploaded files.

share|improve this answer
    
all I have to do is: allow users to upload images to said directory from inside my web app AND allow general traffic to view uploaded images. –  bMon May 26 '11 at 20:03
    
@bMon: Remember there are no users. The only user who is doing anything is the Apache user (you're not running apache as root, right? That'd be a huge no no), since all requests are being handled by the web server. –  Satanicpuppy May 26 '11 at 20:07
    
no apache is not running as root. My only issue is that the photos being upload need to be viewed by all internet traffic. In that case something like 262 won't work, right? –  bMon May 26 '11 at 20:10
    
@bMon: As long as the user that the webserver is running as is in the same group as the group that owns the folder, everyone should be able to see the files. The only thing that matters is whether or not the web server can see the folder (though you may have to add a DIRECTORY directive in your httpd.conf to modify behaviour. I do not recommend allowing .htaccess files in a writable directory). –  Satanicpuppy May 26 '11 at 20:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.