0

I'm finding it hard to find advice on the ideal permissions for a website folder structure on RHEL5.

I want multiple users to be able to change/add/remove files within the website folders - but certain files like the ones containing database passwords need to be protected so that team members can't do anything to them (read/delete).

I was going to create a group 'www', add apache and all the users to that group, add all the files and folders to this group, then make the db password files owned by apache, group apache - however I've found that if the directory has write permissions to the www group, then they can still delete (and recreate) the password file.

Is the only solution to move the password file into it's own directory and remove the write permissions?

2 Answers 2

0

There is probably a better way of doing this, but if you are running on ext2/3 you could make the file immutable using

# chattr +i file

This means that the file cannot be modified, deleted or renamed, not even by root. If you want to change the file you have to chattr -i the file first

1

From the fact that you mention a "db password," I assume that apache is configured to serve some kind of dynamically generated pages from the directory where members of group www have write access.

In that case you cannot keep the secret from members of the group www, no matter where you put it.

The group members can simply upload a malicious script to the server that reads the password and forwards it to them (via email, ftp, http, …).

If the users should not be able to upload code to the server, put them in a sandbox, not the password file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .