What CHMOD settings to keep users from viewing directory?

Question

I have an "includes" directory that my web server should be able to fully interact with, but I don't want users to be able to see its contents.

Answer 1

Permissions on linux (which is what I assume you are using) are in the order:

uuu|ggg|ooo
rwx|rwx|rwx

U being user, the owner of the file. G being group access for a specific group, and O is other.

If the users are not in a group that can access it and they are not the owners of the directory, they fall into the others category, so you only have to modify the last 3 fields.

simplest way to do it:

chmod dir o-r

or

chmod dir 770

770 will give owner and group full access, but take access from the "others". Its pointless to give them write and execute access though if they can't read it (needed to view contents) so you may as well use 770 chmod as opposed to 776 or the like.

Answer 2

You'll need to find the user or group your webserver runs as, and then chown the directory to that user and/or group, then

chmod -R 660 directory

or something similar.

This assumes that you mean local users :) if you mean web users, then you'll have to bear in mind that anonymous web users have exactly the same permissions as your web server, necessarily.

Answer 3

You probably want to use an htaccess file to limit viewing permission of that folder, but read Apache's documentation on the subject for other, better alternatives.

Answer 4

Put the includes directory outside of your web site root directory. You don't want it under your content directory since the web server can then serve it to site users. So if your web site root is /var/www/html make a parallel /var/www/includes directory.

chmod won't do what you want since the httpd process is what will be accessing all of your files, not actual shell accounts. You could restrict access using .htaccess but that is an inferior solution to simply moving your includes directory out of the content area.

Answer 5

@jeremy (since I don't have the rep to comment on his answer): You don't want to chmod 660 a directory, because that will give the owner and group permission denied errors and/or strange output.

e.g.`

ls -l testingjunk
ls: cannot access testingjunk/something: Permission denied

total 0

-????????? ? ? ? ? ? something

I forgot to show this part.

ls -ld testingjunk [16:32]
drw-rw---- 2 wjenkin2 itstaff 4096 2009-07-02 16:30 testingjunk/

`

Answer 6

Assuming that you want web server processes to be able to read and write files in (but not serve up content from) the directory, you want to

• create a directory outside of the document root
• change the ownership of this directory to the user and group your web server runs as
• change the mode of this directory to 0700

If your web server runs as nobody (an unprivileged user that some distributions run multiple server processes under), bear in mind that other processes running as this user may be able to get at the directory as well. If this is a problem, you may want to create a dedicated user for your web server. This will entail changing the web server config and/or startup scripts in addition to creating the user and group.

Since I'm recommending mode 0700, the group is technically not important, but you have to remember that the web server may create files with wider permissions (664 or 775) inside of this directory if the umask of the web server user is set to 002 instead of the more-common 022. A dedicated group will ensure that such files are not inadvertently opened up to writes by other members of a shared group that you might stick the web server user in.

Answer 7

Make sure your web server runs as a user with limited permissions and with a restricted group as its group. Then make sure the files are accessible only by the user and/or group, by removing public read and execute access (public write access should almost never be granted).

Those who maintain the site also need access to the material - preferably not by wielding superuser privileges. That may alter the way you do things.

Consider whether ACLs are appropriate - these would allow you to provide the web server group with read access to the files, the maintenance group with read and write access, and still deny the general public access. Without ACLs, you can only have one set of group privileges.

Answer 8

If you remove read privileges they won't be able to see what files are there. (If you remove execute privileges, then they can't cd to it.)

Answer 9

The 'x' (execute) bit on a directory in Linux/Unix is the one that controls whether you can list the contents of it.