Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an "includes" directory that my web server should be able to fully interact with, but I don't want users to be able to see its contents.

share|improve this question

9 Answers 9

Permissions on linux (which is what I assume you are using) are in the order:

uuu|ggg|ooo
rwx|rwx|rwx

U being user, the owner of the file. G being group access for a specific group, and O is other.

If the users are not in a group that can access it and they are not the owners of the directory, they fall into the others category, so you only have to modify the last 3 fields.

simplest way to do it:

chmod dir o-r

or

chmod dir 770

770 will give owner and group full access, but take access from the "others". Its pointless to give them write and execute access though if they can't read it (needed to view contents) so you may as well use 770 chmod as opposed to 776 or the like.

share|improve this answer
    
I'd think carefully before I give anything 770 –  theotherreceive Jul 3 '09 at 1:38
1  
Giving others execute privilege on a directory will allow them to access a file in that directory (or in a sub-directory of that directory) provided the name is known or guessed. By denying read access, the user cannot read the names from the directory - but the execute (search) privilege means that the files they know about can be opened - if the file privileges allow them to do so. –  Jonathan Leffler Jul 3 '09 at 5:27
    
It was an example, use your common sense. –  John T Jul 3 '09 at 6:10

You'll need to find the user or group your webserver runs as, and then chown the directory to that user and/or group, then

chmod -R 660 directory

or something similar.

This assumes that you mean local users :) if you mean web users, then you'll have to bear in mind that anonymous web users have exactly the same permissions as your web server, necessarily.

share|improve this answer
    
To be useful, a directory needs execute permission for someone - otherwise, only root can access the files. With 660 permission, the owner and the group can see the files in the directory (via ls), but cannot open the files. The write permission does help without the execute (search) permission too (so only root could create files in the directory with 660 permissions). –  Jonathan Leffler Jul 3 '09 at 5:21

You probably want to use an htaccess file to limit viewing permission of that folder, but read Apache's documentation on the subject for other, better alternatives.

share|improve this answer

Put the includes directory outside of your web site root directory. You don't want it under your content directory since the web server can then serve it to site users. So if your web site root is /var/www/html make a parallel /var/www/includes directory.

chmod won't do what you want since the httpd process is what will be accessing all of your files, not actual shell accounts. You could restrict access using .htaccess but that is an inferior solution to simply moving your includes directory out of the content area.

share|improve this answer

@jeremy (since I don't have the rep to comment on his answer): You don't want to chmod 660 a directory, because that will give the owner and group permission denied errors and/or strange output.

e.g.`

ls -l testingjunk
ls: cannot access testingjunk/something: Permission denied

total 0

-????????? ? ? ? ? ? something

I forgot to show this part.

ls -ld testingjunk [16:32]
drw-rw---- 2 wjenkin2 itstaff 4096 2009-07-02 16:30 testingjunk/

`

share|improve this answer

Assuming that you want web server processes to be able to read and write files in (but not serve up content from) the directory, you want to

  • create a directory outside of the document root
  • change the ownership of this directory to the user and group your web server runs as
  • change the mode of this directory to 0700

If your web server runs as nobody (an unprivileged user that some distributions run multiple server processes under), bear in mind that other processes running as this user may be able to get at the directory as well. If this is a problem, you may want to create a dedicated user for your web server. This will entail changing the web server config and/or startup scripts in addition to creating the user and group.

Since I'm recommending mode 0700, the group is technically not important, but you have to remember that the web server may create files with wider permissions (664 or 775) inside of this directory if the umask of the web server user is set to 002 instead of the more-common 022. A dedicated group will ensure that such files are not inadvertently opened up to writes by other members of a shared group that you might stick the web server user in.

share|improve this answer

Make sure your web server runs as a user with limited permissions and with a restricted group as its group. Then make sure the files are accessible only by the user and/or group, by removing public read and execute access (public write access should almost never be granted).

Those who maintain the site also need access to the material - preferably not by wielding superuser privileges. That may alter the way you do things.

Consider whether ACLs are appropriate - these would allow you to provide the web server group with read access to the files, the maintenance group with read and write access, and still deny the general public access. Without ACLs, you can only have one set of group privileges.

share|improve this answer

If you remove read privileges they won't be able to see what files are there. (If you remove execute privileges, then they can't cd to it.)

share|improve this answer

The 'x' (execute) bit on a directory in Linux/Unix is the one that controls whether you can list the contents of it.

share|improve this answer
2  
Um no. The x bit on a directory decides whether one can recurse/navigate into that directory. The r bit controls whether one can list the contents. –  Amit G Jul 2 '09 at 19:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.