0

When I copy my files from development to production /var/www the owner and permission of the files copied changed. What are the perimission/owner of the files in /var/www so that it is not a security risk? What would be the command to change the files to the proper owner/permission of files in /var/www?

Thanks

Improve this question
0

2 Answers 2

Reset to default
1

you may use cp -a to preserve owner/permissions when copying files, so it wouldn't change

Improve this answer
1
  • By doing that then files being copied will inherit proper ownership and permission to those in /var/www. If any file in /var/www has any other ownership or permission is that a security concern?
    – tito_santana
    Feb 23, 2013 at 20:27
0

I assume that all files that you put in /var/www is meant to be published by the webserver, meaning that the below commands does assume that you do not mean to protect the confidentiality of your data, but rather the integrity of your files from being tampered by other users on the system.

Run these commands as root:

find /var/www         -print0 | xargs -0 chown www-data.www-data
find /var/www -type d -print0 | xargs -0 chmod 755
find /var/www -type f -print0 | xargs -0 chmod 644
Improve this answer
4
  • thanks imnt. What do those commands do? When I create a file in prod -> /var/www the default owner is root as is the index.html at installation. When I copy files using sudo nautilus from devlopment /var/www to prod /var/www the owner changes. I can see that when i do ls /var/www. My concern is that if the owner of this files might be a security risk?
    – tito_santana
    Feb 23, 2013 at 20:57
  • Those commands will ensure that the files are owned by the user that executes the webserver software.
    – holmb
    Feb 24, 2013 at 9:14
  • If you want to make certain that a security bug in the webserver software won't allow an attacker to alter the content of the website, then you should change "www-data.www-data" to "root.root" in the commands above. The permissions (755 for directories, 644 for files) will ensure that the file is readable to all users on the system, including www-data. Though doing it this way requires root access to update your site.
    – holmb
    Feb 24, 2013 at 9:19
  • Get back to me if that is your objective, so that I can update the answer for that purpose.
    – holmb
    Feb 24, 2013 at 9:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .