security and permissions

[Brand-X]

I'm just wondering about the best way to setup permissions on a website
with a php editor which modifies the html files for the user depending on
the input from forms. It seems that the .html pages need to be set with
chmod 777 in order for the php scripts to successfully write back to the
server. This doesn't really seem very secure to me and I'm sure there is a
more secure way to set this up.

At the moment the root context is owned by httpd and the files are owned
by the user/site owner although a few files lying around are owned by
admin.

Thanks for any help,

Adam

[Tim Van Wassenhove]

On 2003-12-21, Brand-X <bu*********@NOSPAMhotmail.com> wrote:

I'm just wondering about the best way to setup permissions on a website
with a php editor which modifies the html files for the user depending on
the input from forms. It seems that the .html pages need to be set with
chmod 777 in order for the php scripts to successfully write back to the
server. This doesn't really seem very secure to me and I'm sure there is a
more secure way to set this up.

At the moment the root context is owned by httpd and the files are owned
by the user/site owner although a few files lying around are owned by
admin.

The user, i assume the phpeditor also connects via ftp or scp as this
user, needs rw for the files.

The httpd needs x for directories and r for files. If you want to enable
the generation of index-lists directories need to be readable too.

rwx = 6 for the user
--- = 0 for the group
r-- = 4 for the others (httpd) if file
--x = 1 for the others (httpd) if directory
--
verum ipsum factum

[Geoff Muldoon]

bu*********@NOSPAMhotmail.com says...

I'm just wondering about the best way to setup permissions on a website
with a php editor which modifies the html files for the user depending on
the input from forms. It seems that the .html pages need to be set with
chmod 777 in order for the php scripts to successfully write back to the
server. This doesn't really seem very secure to me and I'm sure there is a
more secure way to set this up.

At the moment the root context is owned by httpd and the files are owned
by the user/site owner although a few files lying around are owned by
admin.

Adam,

If you have a typical config, PHP (and Apache httpd) will be running as
the special system user called "nobody" (which *doesn't* mean just
anybody).

How we do it:
Get root to create a specific user group (eg. webapps).
Get root to grant membership of <webapps> to "nobody" (and depending on
circumstances, to yourself and anyone responsible for maintaining your
PHP scripts).
Set the group ownership of the specific upload directories to <webapps>
and the chmod to 775 rather than 777.

Geoff M