1

I've been thinking about the correct settings that I should have on my live server for my directories. According to this page from the Ubuntu website on file permissions the following is how directory permissions relates to Directories:

Permission     Action                            chmod option

read           (view contents, i.e. ls command)  r or 4

write          (create or remove files from dir) w or 2

execute        (cd into directory)               x or 1

Should my file permissions for my root web directory /var/www/html be 775 or 770? This directory's owner is apache and the group is apache.

I am obviously confused about how this works and I'd like to clear this up as it's important.

As far as I can tell, 770 will allow the owner of the directory to do anything in that directory and will allow all groups that are affiliated with apache to do anything. (For instance, I had to add ftp to the apache group and my username to the ftp group in order to upload files via ftp).

With the 'others' setting set at 0, this means that outsiders shouldn't be able to read, write, cd into the directory or delete anything, but I can still access the website via my browser. Is this because apache is listening for the http request and accessing the directory itself?

If this is the case, what is setting this to 0 stopping people doing? Is this mainly to stop people using ssh to read the contents of a directory? Is there any reason I should have the 'others' flag set at 5 for directories?

Running Centos 5.6. Using PHP.

1
  • @mailq - haha. yes i originally posted this on SO (deleted before i posted this). I've removed my question now.
    – Joe
    Oct 7, 2011 at 16:57

1 Answer 1

1

Should my file permissions for my root web directory /var/www/html be 775 or 770?

People normally use 775.

With the 'others' setting set at 0, this means that outsiders shouldn't be able to read, write, cd into the directory or delete anything, but I can still access the website via my browser. Is this because apache is listening for the http request and accessing the directory itself?

No. Because when you access the website via browser, you're making an effect to this directory under the apache user privileges.

If this is the case, what is setting this to 0 stopping people doing? Is this mainly to stop people using ssh to read the contents of a directory? Is there any reason I should have the 'others' flag set at 5 for directories?

Yes, other users cannot access the directory (cd) and list the content (ls).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .