I'm trying to establish a set of secure ownership/permission standards for /var/www on my server. The ownership is either apache or not-apache, and the permissions are anything from 000-777.

Here's my first attempt. I don't consider myself a server admin, or security knowledgable, so I'm looking for suggestion, feedback, and corrections.

/uploads/ Directories apache:666
( So apache and devs can read/write, but not execute? )

PHP files not-apache:665
( so anybody can exec, but only devs can change? )

.htaccess files, and maybe JS and CSS? not-apache:664
( apache can only read, devs can change? )


The first one won't work - you need to be able to execute a directory to open it (that's what execute does in a unix directory).
I'd recommend adding different users to relevant groups (eg. developers) then giving "anybody" either no permissions or read only (so set the last part to 0). If you only have one relevant group, change the group of the folder to that group and set the permissions recursively to do what you need. Alternatively if you're on a RedHat based distro with acl enabled, look into setfacl - it allows you to give specific permissions on files/folders to users/groups. Two examples below:
setfacl -m user:john:r-x someFile.php
setfacl -m user:michael:--- michael_mustnt_read.txt
setfacl -R -m group:devs:rwx scripts/ - allow the devs full permissions inside this directory.
setfacl -d -R -m group:devs:rwx scripts/ - same as above but doesn't make any changes to existing files, sets the permissions by default on new files.

  • This is something I'll have to look into. I think we are on a RedHat distro. – Robert Kuykendall Aug 20 '10 at 17:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.