Your expert experience and assistance is great, greatly appreciated here.

I have been running a LAMP server for a long time, yet I still struggle with the best way to set file & directory permissions for FTP and WWW protocol activity.

My Control panel is WHM/cPanel (not that it makes a difference), and out-of-the box:

  • files are owned by the user account setup in WHM (eg, "abc")
  • files have a group setting of "abc" as well
  • file permissions are created with 644
  • directories are owned by "abc"
  • directories have a group setting of "abc"
  • directories permissions are created with 0755

Again, these are the default permission settings.

Now everything is fine with FTP activity, but please advise me if any of these file/directory settings create issues, especially with security.

Here's where my struggle comes into play. I have PHP apps that allow a visitor to create, edit, rename, delete, etc. sub-directories and files in certain selected directories. PHP runs as "nobody" on my server.

So in order to get my PHP/Web apps to work, I have had to:

chown nobody *
chgrp nobody *
chmod 0777 *

to everything in these certain & selected sub-directories.

I know this is probably a huge security whole (so don't ask me for any links :) but how should I set all the permissions to allow my FTP user to do his thing while allowing the PHP apps to do their thing will also "minimizing" any security risks and exposures? I know that big CMS systems like Drupal, Joomla, WordPress and so on, handle this.

Thanks ahead of time for reading through this and offering your expert advice!

  • Perhaps something like suphp.org would help.
    – Marc B
    Feb 11, 2011 at 14:47

1 Answer 1


Check this posting from yesterday. It's a useful way to allow both FTP and Apache access to the same files, without either messing with groups or "777" files.

  • Ok, thanks "Coops". I read through the post & thread, especially your comments on unix ACLs. Hmm, I am a PHP developer that does some very high level stuff on my server to make things work -- permissions wise. In other words, I am a bit lost on what to do and how to do what you are proposing (although I really like the notion because I don't want to add another layer or piece of software -- suPHP -- that could do some of the things stating in the thread, if I don't have too. Feb 11, 2011 at 15:21
  • Does anyone know of a good "user-friendly" and non-technical tutorial on Unix ACL? Feb 11, 2011 at 15:27
  • Have you logged in to the command line with SSH at all? To start adjusting permissions it's were you need to be really. The two commands in my post are literally all that is needed.
    – Coops
    Feb 11, 2011 at 19:11
  • @Coops...yes I logged in via PuTTY (which I do very often). I had to ask my SysAdmin to install ACL - which they have done. I ran a GETFACL and it worked so I truly believe I have all the tools I need to help me with my objective. So now, what do I do (ie., how do I use the SETFACL command) to achieve my objective? Feb 12, 2011 at 13:17
  • Further, how should I best undo the -rwxrwxrwx nobody nobody on all my files and dwxrwxrwx nobody nobody on all my directories and make it so that both my FTP user "abc" and my web app can share the dirs/files without leaving the security doors wide open? Feb 12, 2011 at 13:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.