2

How can I give permission to directories and files in www/html for security. This files have an .js , .php , .sh extensions.They execute in www/html by apache's user(mine is www-data). When I give 777 permission to this file and directories , the others which are the same network can see the file content. This is weak security.I want to make strong security. When I give 644 the some of files can't execute.This permission should make strong security and at the same time it is enough to execute file. Which permission must be given to directories and files for this state?

1

Files that are served by Apache (i.e. requested via HTTP) don't need executable permissions to be run, they only need to be readable by Apache.

What I usually do is, set the group to www-data and the permissions to 640 for files and 1750 for directories, so no one else can read them besides the web server.

  • I gave permission to files and directories as you said,but I couldn't execute .php files on browser with apache user www-data.Are you sure that files don't need executable??In both I couldn't see the php files and directories while the file and directory's permissions were as you said.... – Mert Özoğul Jun 22 '14 at 9:04
  • You must have a problem with your Apache configuration then. PHP/HTML files should not have +x permissions, that would be a security hole. Also, you can't see the files with these permissions unless you're the owner or in the www-data group. That's the whole point. – kraxor Jun 22 '14 at 9:15
  • How to configure the apache to execute files in directory which has a permissions as you said. And How am I root in www-data group. Should I use 750 or 1750 permissions for directories. – Mert Özoğul Jun 22 '14 at 9:35
  • Shouldn't .sh and .js files have +x permission. Can permission which you said( 640 for files 1750 for directories) execute this files (.sh (shell script), .js (java script)). – Mert Özoğul Jun 22 '14 at 10:47
0

I usually use the following permissions under /var/www/virtualhost:

chown -R www-data:www-data *
chmod -R 640 *

This ensures that only the HTTP server can see the files. No execute permission is needed for .js and .php files. Shell scripts (.sh files) probably need them if you want to run them as CGI scripts (I've never tried it, so I don't know how to set it up.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.