0

As the title suggests, I need the ability to create, move, and delete files and folders from php.

If I CHMOD all directories and files to 777, everything works great, but if I do 755 then the scripts die with errors about permissions.

From what I've read, using 777 permissions is insecure and should not be done. I have a VPS, but there are multiple users as I host a number of websites (some of which other people are in control of) and, regardless, I want to do whatever is the "best practice."

So, basically, what I'm wondering is how I should go about this? I'm new to php and "webmastering" and am not sure what to do.

Could anyone point me in the right direction?

One last note: In addition to being able to move and delete files that have been created from php, the scripts also need to move and delete files that have been uploaded via FTP from a Windows machine (I've noticed that by default when I upload files the CHMOD is 755).

EDIT: I it may be relevant for me to mention that I ran phpinfo() and found the following under the section "PHP Credits":

User/Group      nobody(99)/99
Nate
  • 26,164
  • 34
  • 130
  • 214

5 Answers5

2

In order to be able to manipulate files and directories without 0777 permissions, those files and directories need to be owned by the same user your PHP scripts run as.

lanzz
  • 42,060
  • 10
  • 89
  • 98
2

Permissions are set for what the owner can do, what the owner's user group can do (the owner's peers in the same user group), and what everone else can do. That's what the 3 numbers are for: 753 is a "7" for the owner, a "5" for the group, and a "3" for everyone else. A "7" is full access (read, write, execute). A "5" is read and execute. You need write access to delete.

You should really read up on linux file permissions to see how they work.

I would recommend you use 775 or 770. The last digit is what anyone on the system or any shmoe browsing your site can do, so you want it as low as possible.

As far as your ftp script and your future other-users, just make sure they are in the same group as your apache user. Or, set up a group for those account you want to have access, and add your apache account to it.

K.A.F.
  • 2,277
  • 1
  • 16
  • 17
1

You don't need to change things to 777, that gives the owner, group and guest all rights (read, write, execute). You can have it set to 755, or even 700 as long as the owner is whatever whatever the PHP process is running under. Typically this will be the Apache user, since the PHP script is running under the Apache process.

You don't need to give execute privs, but you need to give execute on the directories so that the process can do things like change directories (cd).

Brent Baisley
  • 12,641
  • 2
  • 26
  • 39
1

Nate, this relates to the basic 101s of UID and GID based access control. I am assuming that your "multiple uses" each have their own UIDs for FTP (and SSH?) access.

Typically files served by the webserver (Apache) must be read-accessible by the Apache child processes which will be running in www-data (or equiv) and hence must be o:r likewise any directories on the path to them must be o:e.

So you broadly have two options: (i) use a suEXEC / suPHP / FastCGI template to initiate PHP scripts in the UID of the owning directory, and (ii) run your scripts under mod_php5 and make any directories where you need script write-access owned by www-data.

This second approach is the most efficient in terms of machine resources, but it is terribly insecure as it in effect gives userA full R/W access to userB's resources and so on.

There's no way to square this circle. If you cannot guarantee shared trust between all users then you must read up on and implement a solution based on the (i) options.

TerryE
  • 10,724
  • 5
  • 26
  • 48
  • When you speak of userA and userB, does that mean shell accounts or ftp accounts? – Nate Sep 16 '12 at 21:33
  • Doesn't matter. Either. What did you mean by "there are multiple users as I host a number of websites"? If UserA and UserB are executing scripts under `www-data` say (or `nobody`), then they have free reign to r/w to any other user's data, files and D/Bs through their scripts if you use mod_php5. – TerryE Sep 18 '12 at 01:35
  • I meant FTP users, which was why I asked you what you meant. It sounds like maybe I should go with suPHP, but from what I've read it slows things down considerably, and according to this post (http://forums.knownhost.com/showpost.php?p=9934&postcount=6) suPHP can actually decrease security, as if a script is somehow compromised it can rwx any files in the system. I'm not sure what to do... – Nate Sep 18 '12 at 02:06
  • (i) The suPHP o'head is ~100mSec/rec; FastCGI none. (ii) This vuln was closed aboue 2 yrs ago. (iii) give me FTP access to any Apache/mod_php5 served directory on your system and I can read and compromise _every_ mod_pgp5-served user on your system. I won't, but a hacker could and would. – TerryE Sep 19 '12 at 19:33
0

Generally Folders should have 755 and files should have 644 permission set. I'm facing this problem while working on PrestShop project.

Following PHP script solves my problem.

<?php

exec ("find /path/to/folder -type d -exec chmod 0755 {} +");
exec ("find /path/to/folder -type f -exec chmod 0644 {} +");

?>
Viral
  • 1,329
  • 1
  • 9
  • 31