0

On my latest ubuntu version install in the public_html folder I have to set folder permissions to 777 in order for the script to save to certain locations within the public html docs. Why is this?

I was under the impression that 755 was/should be ok for reading and on shared hosting accounts that is usually the case, but on my vps system I need to make the folders 777 in order to make the script work.

the script is phpmydirectory but this issue is true of all scripts I may install on the vps.

Is there a way to make folders 755 and writable as I believe 777 to be a security issue?

Any tips appreciated, thanks.

  • 6
    chmod 777 is NEVER the solution! It's like drinking vodka, first you feel like your problems are solved, but the next morning you'll wake up with a massive headache (likely caused by a hacked server). – Byte Commander Dec 3 '16 at 16:12
  • "Why is this?" please provide more information on the setup: directory lisitings, usernames are needed to tell you why. – Rinzwind Dec 3 '16 at 16:12
  • @Rinzwind The 3 digits refer to 3 different entities: the file-owner, the files-group, and everyone else: 755 says owner has read&write&execute/search and group and other have read&execute/search. 777 says everyone has everything. 7= 4(read)+2(write)+1(search/execute); 5=4(read)+1(search/execute); – ctrl-alt-delor Dec 3 '16 at 17:38
  • You need to look at the owner, and group of the file. – ctrl-alt-delor Dec 3 '16 at 17:40
  • @richard why are you telling me that?! – Rinzwind Dec 3 '16 at 17:44
1

I'm trying to guess: user executing your script doesn't seem to have the required permissions.

For instance, if a php script run by apache web server is used to upload files to a certain subdir, then that subdir should be available for read/write access to your apache user (commonly "apache" or "www-data").

[edit]: when you run a web server, like apache for instance, only the parent process runs as "root", a child process (which is actually the one you care about to run php scripts) usually runs with "www-data" uid on ubuntu/debian platforms.

ps auwx | grep apache | grep -v grep
root      1606  0.0  0.0  63520  3020 ?        Ss   déc.01   0:16 /usr/sbin/apache2 -k start
www-data 22325  0.0  0.0 352676  4232 ?        Sl   06:25   0:02 /usr/sbin/apache2 -k start
www-data 22326  0.0  0.0 352676  4228 ?        Sl   06:25   0:02 /usr/sbin/apache2 -k start

and that explains why it cannot write to your specific subdir in your public_html, if that specific subdir does not belong to that "www-data" user or group.

To fix this, for instance you can set the "group" attribute of your subdir to "www-data", and set write permission to that group:

sudo chgrp -R www-data ./public_html/my_files
sudo chmod -R g+w  ./public_html/my_files

warning: By doing this, you recursively change the group attribute of ./public_html/my_files to www-data, and allow write access to users belonging to the www-data group, thus allowing apache to (over)write files in that folder.

  • all files in public_html are root owned and in root group. – Hawk007 Dec 3 '16 at 21:13
  • that's the problem indeed, your web server process cannot write to these dirs, as it is running as a unprivileged user like "www-data", which cannot write into a subdir owned by root (this is the normal behavior) (assuming your web server is apache) – the_dude Dec 11 '16 at 9:18
  • Thanks the_dude. Il look into makeing those changes soon and post back here when its successful. Thanks again.. – Hawk007 Dec 12 '16 at 11:38
  • Thanks the_dude for the responses. However when you say "This is the normal behaviour" you are hinting that I shouldn't make the changes using the commands above. There are no users on the server as it is just a vps that serves a website php files and I am the only one who as access. Do you recommend I change the ownership as you described or leav them as they are owned by the root and using 777 on specific directories for when website users upload a profile pic for example? Thanks again for the response. Much appreciated. – Hawk007 Dec 14 '16 at 10:31
  • Were it my own VPS, I would prefer to fix things following what are advocated as good practices, in this case even if 777 on a folder would do the trick for the moment, I would try to stick to the rule: just give minimal permissions to the minimum set of users to achieve your goal. in this case, the "rule" would be to give write access to the web server user ( ~ "www-data" or "apache"?) on this specific "pictures" or "files" folder you use to upload pics... Never know what was supposed to be a test would become, and on top of that we prepare our mind and memory to not accept poor standards. – the_dude Dec 20 '16 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.