Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I'm having a problem with apache + php 5.3.5 installed on Debian 6. Apache will not honor the permissions of my files. Apache is running under user & group "daemon" and the files are owned by user & group "myUser".

For example if myfile.php is with permissions 700 apache will execute it although it shouldn't be doing it.

The same configuration works fine under Slackware 13.1. Does anybody know what am I doing wrong?

share|improve this question
That depends entirely on your configuration of apache -- I can already tell it's not debian's own stock variant of apache because that one runs as www-data; does your config include suphp or suexec ? – Shadur Jun 23 '11 at 15:18
No it doesn't have suphp/suexec. It's a standard installation. :) – tftd Jun 23 '11 at 15:20
Standard debian installation will use www-data as the apache user, not 'daemon'. Try again. – Shadur Jun 23 '11 at 17:42

2 Answers

up vote 1 down vote accepted

As far as I remember, without a special module to do so, Apache doesn't care about your files permissions. If it can read a file, it can serve it.

You should use .htaccess files with Allow/Deny statements for protecting files.

Also note regardless of configuration, modules, software etc. you should never put any private files in a folder Apache can read! Someone slips up and changes the wrong line in your config and everyone can get at your private files.

Apache should be restricted to a single, or a few folders. Standard setup is /var/www/html/ and /var/www/cgi-bin/ and nowhere else.

share|improve this answer
I'm not putting private files where apache is standing. I need to disable php scripts so that they stop running for a moment or two. The way I was doing it in Slack was just removing the +x permission on the file. With Debian it'll not work... :) – tftd Jun 23 '11 at 22:21
2  
@TheDevil Oh in that case no it won't make any difference, For PHP to work (assuming you're using mod_php) they only need to be readable by Apache because they're not directly executed, just run through the PHP parser. Your best option is to use .htaccess files to disable them, if you really wanted to do it using permissions remove read permissions from Apache and they'll start throwing 403 in Apache till you change them back – sam Jun 23 '11 at 22:45
up vote 1 down vote

Check if the setuid or setgid bit is set on your files: ls -l

If you have a s or t in your permissions where x should be, then the setuid/setgid bit is set. Setuid and setgid are access rights that allow users to run an executable with the permissions of the executable's owner or group.

share|improve this answer
Additionally, the user might want to check with getfacl just to make sure there aren't any extended ACL entries on that file. – Shadur Jun 23 '11 at 17:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.