Writing files in a sub folder of the web folder (apache security)

Question

I need to save session data for a dynamic web page script by writing to file. I have two questions:

1. Are there any security preferences as to whether to save the data UNDER the web folder, or OUTSIDE the web folder?

2. I attempted to write to the folder an (unsuprisingly), I had a 'file permission refused' type error. Should I set the folder ownership to the apache user (600, 640 or 644?)

[[Edit]]

core     <- 'OUTSIDE' web folder (php script live here)
data     <- 'OUTSIDE' web folder (session data and other misc data resides here)
web      <-  web root folder
   js    <-  any folder below is 'INSIDE' the web folder
   css
   html  

For example, in a php script (i.e. a dynamic PHP page), I can attempt to write to a file using something like fput('../data',data) yet (as I understand it) ../data should not be accessible - for security reasons.

Could someone please provide a simple example that shows how to provide access to ../data/ in the example given above?.

What are the actual SPECIFIC steps required?

BTW, I am running on a LAMP stack.

Answer 1

There absolutely is a security preference to save sensitive data outside of your web root. If you don't want random users being able to access the data, then don't put it under web root.

Sure, you can set the file permissions to be non-readable or configure Apache to deny access to the file or use mod_rewrite to block attempts to access the file, but these security mechanisms are much more error prone and more inconvenient than simply putting sensitive data outside of the web root. And session data definitely qualifies as sensitive data.

And what to set the folder permissions to depends on your server setup. On a standard LAMP setup, PHP will execute as the same user as Apache (often nobody). However, under shared hosting the PHP script is often run under the domain's own SFTP/shell user. But either way, you shouldn't be giving other users read access to your session data.

Answer 2

Some generalised rules about security will save you a lot of pain. Yes, it is technically possible to store updatable content within the webroot. But you need to ensure that stuff you don't want to be changed by users can't be changed by users, and that the storage of content cannot be used to host data that shouldn't be there, and that there is no direct access to the cotnent via the webserver, and that the stored data is not itself code (PHP, javascript, ssi...). Life becomes a lot simpler when you store user submitted data elsewhere. Also, making the entire contents of the webroot readonly to the webserver helps.

I had a 'file permission refused' type error. Should I set the folder ownership to the apache user (600, 640 or 644?)

This is a much more general question. I usually define a couple of groups (and make good use of the setgid flag on directories) one including site admins but excluding the webserver uid (webdev) and one with site admins and webserver uid (webdata). All files within the web root are readable by others by only writeable by webdev. The data directory (session files, some dynamic content) is writable by the webdata group. But this might not be the right model for you. Making directories/files .rwxrwxrwx should be a last resort.

Also, try not to use relative directories when referencing different parts of your site. It makes the site as a whole movable - but undermines the ability to move parts of the site easily. If you define a base url in your config then use this a prefix to paths you get the best of both worlds.