How can I give permission to directories and files in www/html for security. This files have an .js , .php , .sh extensions.They execute in www/html by apache's user(mine is www-data). When I give 777 permission to this file and directories , the others which are the same network can see the file content. This is weak security.I want to make strong security. When I give 644 the some of files can't execute.This permission should make strong security and at the same time it is enough to execute file. Which permission must be given to directories and files for this state?
Files that are served by Apache (i.e. requested via HTTP) don't need executable permissions to be run, they only need to be readable by Apache.
What I usually do is, set the group to www-data and the permissions to 640 for files and 1750 for directories, so no one else can read them besides the web server.
I usually use the following permissions under /var/www/virtualhost:
chown -R www-data:www-data * chmod -R 640 *
This ensures that only the HTTP server can see the files. No execute permission is needed for .js and .php files. Shell scripts (.sh files) probably need them if you want to run them as CGI scripts (I've never tried it, so I don't know how to set it up.