Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to make my folder owned by "apache" and then chmod that folder so that only the owner and group can access it. I am trying to do this to keep visitors from executing user-uploaded files directly. Here are the commands I am using:

chown -R apache uploads
chmod -R 770 uploads

Source: http://www.mysql-apache-php.com/fileupload-security.htm

Instead it seems that although it is keeping visitors from seeing the files, it is not allowing apache to serve them. Do you have any ideas?

share|improve this question
    
may want to try chown ing to apache:apache, too –  warren Nov 9 '09 at 2:58
1  
You really do not want to make everything under your uploads directory executable; you only want execute permission on the directories. –  Jonathan Leffler Mar 25 '10 at 3:53

2 Answers 2

as mostly stated above:

  • Your comands look fine, so I suspect there`s something wrong with the assumptions surrounding what you do
  • please make shure that the apache user and group are called "apache" and not "apache2", "httpd" or "www-data" ore some such name
  • chmod -R 770 sets the execute-bit on directories and files in those directories. You should only set the "x"-bit on directories to allow dir-traversal.

if you want to exclude all users of the group "users" from accessing the "upload"-dir, you could assign that directory explicitly to group "users" and then set restrictive group permissions:

# group permissions override permissions for "others"
chown -R www-data:users /mydir
# group has no permissions, "others" can read and traverse
chmod 0705 /mydir
# change permissions on subdirs only
find /mydir -type d -exec chmod 0705 {} \;
# files should by default not be executeable anyway
find /mydir -type f -exec chmod a-x,o-w {} \;

If you want to find the apache user, do (on linux only)

ps axu | grep apache | grep -v root 

and look at the leftmost column. Maybe substitute apache with httpd in the grep command. Cheers,

Nik.

share|improve this answer

The world bit needs to be read only. Try chmod -R 774 uploads.

Should have read the document too first. :) Seems like 770 should work. Make sure that the apache daemon user and group own uploads. The group part is important to serve the files via web browser.

share|improve this answer
    
thank you :) how do i find out what the apache daemon user is? I am kind of confused about which command I would run –  Chris B Sep 13 '09 at 14:35
2  
Look in your httpd.conf file (usually /etc/apache2/httpd.conf) and look for the User and Group entry, usually like this: # If you wish httpd to run as a different user or group, you must run # httpd as root initially and it will switch. # # User/Group: The name (or #number) of the user/group to run httpd as. # It is usually good practice to create a dedicated user and group for # running httpd, as with most system services. # User www Group www In this case, it indicates the user is www and group is www, so ownership of uploads should be <code>chown -R www:www uploads</code>. –  churnd Sep 13 '09 at 15:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.