Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What permissions should I set, and how, to allow apache to overwrite uploaded images, deleting them and re-uploading them, as well as allowing the permissions on the underlying folders to be passed to new uploaded files (if that's the proper approach)?

My images directly is, for example: /images/subset1/ /images/subset2/ /images/subset3/

Pretty standard, with images uploaded into each subset folder.

share|improve this question

migrated from stackoverflow.com Aug 8 '12 at 7:52

This question came from our site for professional and enthusiast programmers.

    
644 owner is usually www-data –  marabutt Jul 25 '12 at 22:53
add comment

1 Answer

up vote 2 down vote accepted

To make Apache able to read and write a directory, that directory must be:

  • owned by user apache, and mode 7xy (6xy for files); x and y may both be zero;

OR

  • owned by another user, but group ownership same as Apache, and mode x7y or x6y (x is usually the sum of 2 = file write and 4 = file read, therefore 6, and 1 = directory scan, therefore 7 for directories)

OR

  • owned by an user different from Apache's, a group different from Apache's, and mode xy6 or xy7. This means that the file is writeable by ABSOLUTELY ANYONE, and therefore a bad idea. Try having file ownership changed to fall in one of the more reasonable cases above.

To change permissions, you need to have ownership of the file/directory. Then you can change permissions via the shell (chmod command) or through FTP. To change ownership you must be the super-user, root, and can't do that by FTP, need some kind of shell access to run the chown utility or some GUI variation thereof.

Your best option is, I think, to keep files and directories owned by a non-Apache user and without access permissions except 4 (read) + 1 (=5) for directories. Then in a limited set of special directories, have Apache ownership and permissions 600 (files) and 700 (subdirectories). If possible, then, configure the Web server (PHP, python, etc.) to NOT interpret files from the writeable area. There, Apache will be able to write everything, but not execute it.

This is because having ALL files writeable by Apache would possibly allow someone to upload executable code, thereby "ordering" the server to do something which you wouldn't like (sending spam, escalating privileges, running portscans and bot nets...). If the possibility of writing files is desired, those files should be prevented from ever being run.

share|improve this answer
    
Ok, so apache being able to write everything in these image directories would be set via .htaccess or apache config somewhere, but what kind of directive should I be looking for to prevent interpretation as executable by apache for those folders? I'm also just trying (for my own understanding) to translate the permissions 600 for files and 700 for subdirectories into symbolic permissions. I believe that would be chmod u+rw,go-rwx for files, and chmod u+rwZ,go-rwx for directories (with the Z standing for I am not sure what, X? or s? Not sure of the symbolic rep. of direct. scan. –  Kzqai Jul 25 '12 at 23:38
    
Ok, it seems to even view, you need X, so evidently that is the symbolic permission to add. What should I look into for apache to prevent execution within a directory? –  Kzqai Jul 26 '12 at 0:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.