Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I wish to set my whole web architecture owned by root:root, and allow the apache user reading rights only.

I don't know whether it is possible: chmod -R 744 makes it return a E403 from the browser, pemission denied to access xxxx.php

But since Apache is public ("other"?) it should be able to "read" right? I don't understand it. I also tried chown root:apache but the result is the same, which is even more confusing...

share|improve this question
    
Don't use root for things that are better handled with normal user accounts, such as this. –  Michael Hampton Mar 10 '13 at 4:30
    
@MichaelHampton, the idea was to protect the files from apache. But I realised I can do the same to proper files permissions. –  Sebas Mar 10 '13 at 11:57
add comment

2 Answers

Files need 644, directories need 755. Using 744 on the whole tree means Apache does not have permission to read the contents of any of the directories.

Also, depending on the OS, you may run into problems with kennel security mechanisms (apparmor, selinux) if you use a non-standard location like /www.

I'll provide some example commands for cleaning up the perms when I'm not on my phone.

EDIT:

This will set the files and directories to be world readable:

find /www -type f -exec chmod 644 {} +
find /www -type d -exec chmod 755 {} +

To clarify what I said earlier about file vs directory permissions:

  1. Files don't need the execute bit to be read. Permissions of 0744 would set the file permissions to look like this: -rwxr--r--
  2. Directories need the execute bit and the read bit. This StackOverflow article provides an excellent overview of how directory permissions work.

EDIT (again):

Just noticed the Centos tag, so you can disregard the apparmor caveat. And I think SELinux is off by default, so that shouldn't be a problem either. Fixing the permissions should be all you need.

share|improve this answer
    
Hmm I have some questions. When I set all the files to apache:apache, everything works fine with chmod -R 500. Are you sure the 755 permission is really mandatory? –  Sebas Mar 10 '13 at 0:48
    
You're correct; my example left write enabled by root. If you want the files to be owned by root:root and still be readable by apache, you could go with 555 and 444 (dirs / files). –  Insyte Mar 10 '13 at 1:12
    
thanks, I'll give it a shot soon –  Sebas Mar 10 '13 at 1:13
    
The key point is to not use the same perms on both files and directories. You don't want files in your web root to end up with executable permissions on them. –  Insyte Mar 10 '13 at 1:14
    
oh, what could happen? –  Sebas Mar 10 '13 at 1:19
show 1 more comment

Look into using ACLs. You'll be able to leave root as the owner and still give apache access (without chmod'ing files to a point where it compromises security).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.