1

I am trying to make my folder owned by "apache" and then chmod that folder so that only the owner and group can access it. I am trying to do this to keep visitors from executing user-uploaded files directly. Here are the commands I am using:

chown -R apache uploads
chmod -R 770 uploads

Source: http://www.mysql-apache-php.com/fileupload-security.htm

Instead it seems that although it is keeping visitors from seeing the files, it is not allowing apache to serve them. Do you have any ideas?

2
  • may want to try chown ing to apache:apache, too
    – warren
    Nov 9, 2009 at 2:58
  • 1
    You really do not want to make everything under your uploads directory executable; you only want execute permission on the directories. Mar 25, 2010 at 3:53

2 Answers 2

1

as mostly stated above:

  • Your comands look fine, so I suspect there`s something wrong with the assumptions surrounding what you do
  • please make shure that the apache user and group are called "apache" and not "apache2", "httpd" or "www-data" ore some such name
  • chmod -R 770 sets the execute-bit on directories and files in those directories. You should only set the "x"-bit on directories to allow dir-traversal.

if you want to exclude all users of the group "users" from accessing the "upload"-dir, you could assign that directory explicitly to group "users" and then set restrictive group permissions:

# group permissions override permissions for "others"
chown -R www-data:users /mydir
# group has no permissions, "others" can read and traverse
chmod 0705 /mydir
# change permissions on subdirs only
find /mydir -type d -exec chmod 0705 {} \;
# files should by default not be executeable anyway
find /mydir -type f -exec chmod a-x,o-w {} \;

If you want to find the apache user, do (on linux only)

ps axu | grep apache | grep -v root 

and look at the leftmost column. Maybe substitute apache with httpd in the grep command. Cheers,

Nik.

0

The world bit needs to be read only. Try chmod -R 774 uploads.

Should have read the document too first. :) Seems like 770 should work. Make sure that the apache daemon user and group own uploads. The group part is important to serve the files via web browser.

2
  • thank you :) how do i find out what the apache daemon user is? I am kind of confused about which command I would run
    – Chris Bier
    Sep 13, 2009 at 14:35
  • 2
    Look in your httpd.conf file (usually /etc/apache2/httpd.conf) and look for the User and Group entry, usually like this: # If you wish httpd to run as a different user or group, you must run # httpd as root initially and it will switch. # # User/Group: The name (or #number) of the user/group to run httpd as. # It is usually good practice to create a dedicated user and group for # running httpd, as with most system services. # User www Group www In this case, it indicates the user is www and group is www, so ownership of uploads should be <code>chown -R www:www uploads</code>.
    – churnd
    Sep 13, 2009 at 15:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .