Are these the right permissions for a webserver

Question

I understand by now that 777 is very dangerous to have as permission on folders in my webserver, and I wan't to change them to 755 for folder and 644 for files as suggested here.

Im using the following code from the link above.

# Set group to www-data
sudo chgrp www-data /var/www
# Make it writable for the group
sudo chmod 775 /var/www
# Set GID to www-data for all sub-folders
sudo chmod g+s /var/www
# Add your username to www-data group
sudo usermod -a -G www-data username
# Finally change ownership to username
sudo chown username /var/www/
# Your account shouldn't have any more permission issues

I have set the rights to 777 with filezilla (before I knew how unsafe it was), the reason was because I needed to upload files but didn't have the right permissions. If I run this code how do I make sure there are no other users that still have the unsafe permissions?

I have replaced the username with the user I use for logging in to filezilla etc (with ssh).

Answer 1

If I run this code how do I make sure there are no other users that still have the unsafe permissions?

Think of it in terms of the file system, and less in terms of users having specified permissions. The permissions set on the folders / files are what matters, followed by the users who are part of whichever groups you have assigned to the folders/files. So what you want to check is which users belong to the group youve given the read-write-execute permission to.

An easy way to check what members are in a group are with the members program:

sudo apt-get install members
members www-data

That last command would list which users are in the group that has rwe permissions on the directories you've listed.

Without installing any new software packages, you could just grep the /etc/group file, and read the last part of the output for a particular group:

grep 'www-data' /etc/group

Users assigned to this group will be printed at the end of the output. More on the group file here.

Answer 2

If your web server run as www-data and your user belong to www-data group is sufficient:

sudo chown -R username:www-data /var/www/

(-R is for recursion) and

find /var/www/ -type f -exec chmod 640 {} \; && find /var/www/ -type d -exec chmod 750 {} \;

You do not need to assign rights to other users, so 750 is the best choice in my opinion.

• the find changes files to 640 and the directories to 750 (type f and type d are the main parts in there). If you need more permissons 660 and 770 are the next step (execute permissions for group).