Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to figure out the best file permissions/user/groups for files under my document root? I have the following file structure with /home/user/public_html holding all my php files and directories. Inside that, I have one directory /home/user/public_html/files/where people upload images to.

What is the most secure way to distribute file permissions/groups/user so that apache can properly display the php files and directories?

Should I make public_html owned by apache? What group should I use for public_html?

share|improve this question

1 Answer 1

Is this server used by any others, or just yourself (ie. is it dedicated or shared).

Generally, best practice is rwx for the owner and read-only for anyone else. If you are running PHP as mod_php (without a custom Apache build, eg. mpm-per-child), then you'll want www-data/apache (whoever Apache is running as) to have full rwx access, the FTP/SSH user will also need rwx access.

So its likely to make the owner your FTP/SSH user with rwx, the group the Apache user with rwx and just read-only or nothing at all to everyone else.

Eg. 774 or 770

Again, if your FTP/SSH user is not the same as your PHP/Apache user then you'll want to make sure your file permissions stay as they should be, even when each respective user creates new files.

ftpuser=""
apacheuser=""
chown -R ftpuser:apacheuser /home/$ftpuser/public_html
chmod -R 775 /home/$ftpuser/public_html
setfacl -d -m u::rwX,g::rwX,o::rx /home/$ftpuser/public_html
chmod g+s /home/$ftpuser/public_html

To use the above commands, you'll need to make sure that you enable ACLs for your active partition, see http://www.vanemery.com/Linux/ACL/linux-acl.html

But it would be preferred to use PHP-FPM, then you can run the PHP instance as a specific user (and more), and no more permissions headaches.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.