3

I was reading the following question as I have the same issue: FTP and Apache permission issues

The first solution, while not the accepted one, seems to be close to what I need. I've added both users to the same group and chown'd all files to that group, I haven't yet changed all file permissions to allow the group to write.

Given that apache is supposed to execute any uploaded files, does that means the permissions for the files should end up being 775? If so, does that mean I should set my FTP umask to be 002? What are the security implications (if any) of changing all files in my web directory from 755 to 775? I presume there are none as long as who is within the group is controlled anyway.

Thanks

1 Answer 1

1

Apache doesn't need execute permission on the files inside the docroot but do need execute permission on the directories. Eg. To browse directories using "Indexes" options.

Generally the system has a default umask value of 022. So any directory that is created has 0744 permissions and the files have 0644 permissions.

To make things work, you've to follow these steps,

  • Change the primary group for the FTP user to apache.

    usermod -g apache

  • Or you can even add apache as a secondary group for the FTP user and change the FTP daemon's config file. You can easily do this in proftp and vsftp.

  • Fix the permissions in the docroot

    chmod -R g+w /path/to/docroot

  • Set the umask value of in the FTP daemon to 002. If everything inside the docroot is owned by apache then you may even consider using 007.

1
  • Well indexes are turned off for security, does that mean execute permissions aren't needed on anything? Right now I have a group called ftp_users, my ftp user and apache are both in that group. I have chown'd all files to :ftp_users
    – Peter
    Oct 30, 2012 at 13:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .