I would recommend the find command for setting permissions:
To make all directories search-able and readable by everyone by everyone (see this link for Unix directory permissions, the permissions have different meanings from files):
sudo bash -c "find /var/www/root/images -type d -print0 | xargs -0 chmod oga+rx"
For the files:
sudo bash -c "find /var/www/root/images -type f -print0 | xargs -0 chmod oga+r"
And to make sure nobody members of group all can't write to anything:
sudo bash -c "find /var/www/root/images -type f -print0 | xargs -0 chmod a-w"
The reason I set the permissions of the owner, group, and all is because even if all has read permission, if the owner doesn't, the owner won't be able to read the file.
Execute is permission 'x' is generally refereed to as 'search' permissions when used with directories. You will also need search permission on all the directories up to the root, from the above link about directory permissions:
Search permission is required in many
common situations. Consider the
command "cat /home/user/foo". This
command clearly requires read
permission for the file foo. But
unless you have search permission on
/, /home, and /home/user directories,
cat can't locate the inode of foo and
thus can't read it! You need search
permission on every ancestor directory
to access the inode of any file (or
directory), and you can't read a file
unless you can get to its inode.
So in my example, you will need search (+x) permission on /var, /var/www, /var/www/root, etc as well.
Don't use a+rX, sorry to put it in a post, but I need to code tags a don't know how to use them in a comment. The following doesn't only effect directories, it can effect files as well if a user already has execute permission.
chmod -R a+rX images
Example:
[kbrandt@kbrandt-opadmin: ~/scrap/X] touch XnotOnlyDirectories
[kbrandt@kbrandt-opadmin: ~/scrap/X] ls -l
total 0
-rw-rw-r-- 1 kbrandt kbrandt 0 2009-08-11 06:29 XnotOnlyDirectories
[kbrandt@kbrandt-opadmin: ~/scrap/X] chmod u+x XnotOnlyDirectories
[kbrandt@kbrandt-opadmin: ~/scrap/X] ls -l
total 0
-rwxrw-r-- 1 kbrandt kbrandt 0 2009-08-11 06:29 XnotOnlyDirectories
[kbrandt@kbrandt-opadmin: ~/scrap/X] cd ..
[kbrandt@kbrandt-opadmin: ~/scrap] chmod -R a+rX X
[kbrandt@kbrandt-opadmin: ~/scrap] ls -l X
total 0
-rwxrwxr-x 1 kbrandt kbrandt 0 2009-08-11 06:29 XnotOnlyDirectories
From the chmod man page:
execute/search only if the file is a
directory or already has execute
permission for some user (X)
When it comes to Apache:
There is no definitive right way that I am aware of, you can use the permissions I have set and run Apache as the user nobody, or you can user a group or user for apache such as 'apache' or 'www-data'. See this link. If go the nobody route, make sure nobody has the right userid:
[kbrandt@kbrandt-opadmin: ~/scrap] id nobody
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)