Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am setting up a simple website on webspace provided by my university. I do not have database access so I am storing all the data in a flat file. The issue I am experiencing is related to file permissions. I need PHP to be able to read and write the data file but I don't really want to set the file to 777 as anybody else on the system could modify it, they already have read access to everyone's web directories. Does anyone have any ideas on how to accomplish this?

Thanks in advance

share|improve this question
1  
Change the owner or group to the webserver user and give the webserver user and yourself write permission to the file –  topdog Sep 18 '12 at 13:07

3 Answers 3

Just set 0755 (or lower) but make sure that directory owner is user in which context is apache (or other webserver) running.

for example

chown apache:apache /var/www/html

You can get info about user using phpinfo() for example.

UPDATE

If you are sharing apache with more sites, then you should separate your content by Per-user web directories

http://httpd.apache.org/docs/2.2/howto/public_html.html

share|improve this answer
1  
This looks good but wouldn't everyone on the server potentially be using the same copy of Apache and could then create a script to overwrite my files? –  camerongray Sep 18 '12 at 13:16
    
Yes, that's correct, see my updated answer –  user106666 Sep 18 '12 at 13:57
    
per-user web directories don't really help. Apache is still running as Apache. –  Zoredache Sep 18 '12 at 16:17
    
@Zoredache what you mean by don't help? This is exact case for mod_userdir –  user106666 Sep 18 '12 at 16:37
    
Files written by Apache will under mod_userdir will still be owned by Apache. Nothing prevents one user from writing a script to by be run by Apache that will snoop in other users directories. –  Zoredache Sep 18 '12 at 16:40

You may use suPHP to accomplish this task. If you can use it, then simply change the file permissions to 0700 and everything shall work as you want.

share|improve this answer

The ideal situation would be if the filesystem on the server supports posix acls so you can add write access to certain files for the uid the webserver runs under.

And you have enough access to the filesystem (preferably via a shell account) to set acl rights.

See man acl for an overview and man setfacl for details on how to set them.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.