Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

When I copy my files from development to production /var/www the owner and permission of the files copied changed. What are the perimission/owner of the files in /var/www so that it is not a security risk? What would be the command to change the files to the proper owner/permission of files in /var/www?

Thanks

share|improve this question
add comment

2 Answers

you may use cp -a to preserve owner/permissions when copying files, so it wouldn't change

share|improve this answer
    
By doing that then files being copied will inherit proper ownership and permission to those in /var/www. If any file in /var/www has any other ownership or permission is that a security concern? –  tito_santana Feb 23 '13 at 20:27
add comment

I assume that all files that you put in /var/www is meant to be published by the webserver, meaning that the below commands does assume that you do not mean to protect the confidentiality of your data, but rather the integrity of your files from being tampered by other users on the system.

Run these commands as root:

find /var/www         -print0 | xargs -0 chown www-data.www-data
find /var/www -type d -print0 | xargs -0 chmod 755
find /var/www -type f -print0 | xargs -0 chmod 644
share|improve this answer
    
thanks imnt. What do those commands do? When I create a file in prod -> /var/www the default owner is root as is the index.html at installation. When I copy files using sudo nautilus from devlopment /var/www to prod /var/www the owner changes. I can see that when i do ls /var/www. My concern is that if the owner of this files might be a security risk? –  tito_santana Feb 23 '13 at 20:57
    
Those commands will ensure that the files are owned by the user that executes the webserver software. –  holmb Feb 24 '13 at 9:14
    
If you want to make certain that a security bug in the webserver software won't allow an attacker to alter the content of the website, then you should change "www-data.www-data" to "root.root" in the commands above. The permissions (755 for directories, 644 for files) will ensure that the file is readable to all users on the system, including www-data. Though doing it this way requires root access to update your site. –  holmb Feb 24 '13 at 9:19
    
Get back to me if that is your objective, so that I can update the answer for that purpose. –  holmb Feb 24 '13 at 9:20
    
@tito_santana did you find the answer acceptable? –  holmb Mar 10 '13 at 15:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.