Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm finding it hard to find advice on the ideal permissions for a website folder structure on RHEL5.

I want multiple users to be able to change/add/remove files within the website folders - but certain files like the ones containing database passwords need to be protected so that team members can't do anything to them (read/delete).

I was going to create a group 'www', add apache and all the users to that group, add all the files and folders to this group, then make the db password files owned by apache, group apache - however I've found that if the directory has write permissions to the www group, then they can still delete (and recreate) the password file.

Is the only solution to move the password file into it's own directory and remove the write permissions?

share|improve this question

2 Answers 2

up vote 0 down vote accepted

There is probably a better way of doing this, but if you are running on ext2/3 you could make the file immutable using

# chattr +i file

This means that the file cannot be modified, deleted or renamed, not even by root. If you want to change the file you have to chattr -i the file first

share|improve this answer

From the fact that you mention a "db password," I assume that apache is configured to serve some kind of dynamically generated pages from the directory where members of group www have write access.

In that case you cannot keep the secret from members of the group www, no matter where you put it.

The group members can simply upload a malicious script to the server that reads the password and forwards it to them (via email, ftp, http, …).

If the users should not be able to upload code to the server, put them in a sandbox, not the password file.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.