3

I am running several websites on my dedicated server and a lot of my sites require that some directories have permissions set to 777. I know this is a major security issue, and I also know it's possible to configure things so you don't have to use 777 on directories, I just don't know to do it. Can someone point me in the right direction so I can stuff function without having 777 directories?

Thanks!

Improve this question

3 Answers 3

Reset to default
3

When I discovered unix ACLs a few years ago they amazed me! It is also amazing how they aren't common knowledge.

In short they allow you to set extended file permission, beyond that of simple user+group+other classically documented.

The two commands you want are "setfacl" and "getfacl". You may need to remount your fs with acl support if it complains "mount -o remount,rw,acl /".

The two common ways I use setfacl are:

setfacl -R -m u:apache:rwx /var/www/mydirectory
setfacl -R -d -m u:apache:rwx /var/www/mydirectory

The first line recursivley added rwx permissions to everything in the given path (on top of the permissions already in place). The second command makes the default policy for new files and directories to automatically have rwx for the apache user.

This is sooo much quicker than messing with suPHP or group permissions etc.

Improve this answer
2

Since you're in control of the server, you might consider running PHP through suPHP. The PHP processes are spawned for a distinct user. That way your directories can be chmodded to 0700 with ownership to the user the processes are running under.

P.S.: See you on serverfault. I voted to move.

Improve this answer
4
  • Whilst I voted to move it, I voted to move it to webmasters.SE, which I think is a better fit for this one.
    – Orbling
    Feb 10, 2011 at 19:31
  • @Orbling Setting up suPHP is a quest of its own and also related to administrators than webmasters (?). I think the questions is better placed here...
    – Linus Kleen
    Feb 10, 2011 at 19:33
  • Webmasters is the web specific site of server administration for the most part, this is very web specific. Though I did up-vote your answer, suPHP is the way to go on that.
    – Orbling
    Feb 10, 2011 at 19:39
  • @Orbling 1: Thanks for the vote. 2: Personally, I distinguish between administrators setting up the environment software runs on and "webmasters" maintaining the software.
    – Linus Kleen
    Feb 10, 2011 at 19:43
2

If you have to run with things set to 777, it means you have some ownership problems.

Generally speaking there are only three groups of users you have to worry about:

  • the actual users who are setting the web application up;
  • the uid that the web server (and probably PHP) runs under; and
  • everyone else.

Usually you should be able to set the ownerships of the files and directories to be the actual user doing the setup, and the group membership to be the group membership of the web server. If you do that, then you can set the permissions on most things to be rwx for the owner, and rx for the apache group; your application notes should be very specific as to what directories the application requires write-access. (If it isn't, it's probably written loosely in other ways too and may be a security vulnerability.)

If you do it correctly, then "everyone else" (which is "everyone as users on the server who are not members of the web server's group") can have their permissions set to 0 (ie no-read, no-write, no-ex).

For example, my WordPress installation is installed by me, but run by the webserver, so everything is generally permission 750, ownership dave:apache. The directory where wordpress stashes incoming uploads is set for permission 770, ownership dave:apache.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .