I have an apache server set up, there is a php script for a login page (contains passwords).

I want to be able to give the server permissions to run the script but not for users who login through the script to access the login.php through webmin(which is installed on the server). The permissions for users who connect through webmin is set to the same as a user named 'front' which is not the owner. The login.php file is is set so the owner is root.

After running the command 'sudo chmod 777 ~directory of file~' the server could open the login page but obviously users who open file manager through webmin can also reead the usernames in the login file.

So I set the permissions to 'sudo chmod 200 ~directory of file~' this worked as I wanted. However upon restart the server would no longer display the login page (I assume somehow the permissions did not allow this).

I then set the permission to '777' (everything worked but not secure) then back to '200' which made the login-page load and the users weren't able to access the login.php file. Now I have to run both these commands (in that order) whenever I restart the server,

what could be causing this?

note: the users need to access the web-directory to edit pages but should not be able to read that specific page.

  • 1
    " login page (contains passwords)." I believe here you go wrong. You store encrypted password with a salt in a login page and match the password with what was inserted ON THE SERVER. "edit pages but should not be able to read that specific page." editing means being able to read it. – Rinzwind Feb 9 '15 at 18:20
  • @Rinzwind security is not much of a priority, they should be able to edit/read pages other than "login.php" sorry for not being clear – Display Name Feb 9 '15 at 19:28
  • Security should always be a priority, unless this setup is LAN only. Insecure servers on the Internet effect us all. – geoffmcc Feb 9 '15 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.