0

The people I work with have the tendency to set the access mode in numerical notation to 777 every time they face access right problems.

The mess is caused by using many users.

  • The creator of files (user: john),
  • The php interpreter (user: www-data),

I'm wondering if there exists a preferred / best / safest access mode setting for directories containing php scripts and the php script itself.

Improve this question
2
  • 3
    Simple: Don't let devs change permissions of directories in deployment. In fact, don't let devs touch the deployment at all! Create a deployment pipeline that handles these things for you.
    – user163495
    May 14, 2019 at 11:26
  • This is actually funny as two years ago I have had a long discussion with Microsoft regarding the 777 permissions on their Azure Web server. Even if their best security practices for IIS were saying how to secure web directories they did it in another way. The final answer was more funny I was expecting. There is a Wordpress and it needs to be able to update itself. It is not a bug, it is a feature!
    – Fis
    Oct 11, 2019 at 16:48

2 Answers 2

Reset to default
1

Always try to use the minimum permissions required to do the job, like this you can protect against current and unknown threats. With this in mind, there are three requirements that can be extracted from your explanation:

  • john needs to be able to read and edit the files
  • www-data needs to be able to read the files
  • Other users on the system have no business with the content of the files

To meet these requirements one common pattern is to create a group with only john and www-data as members, say phpgroup and have the PHP files (and the directories where these are located) owned by user john and group phpgroup.

For files the permissions will then be 640 (rw-r-----) and for the directories you will need to add the execute bits so that both users are able to change to it, e.g. 750 (rwx-r-x---).

Improve this answer
2
  • Just to add, its a good practice that folders accessible from the web are read only (executable if neccessary). Temporary folders should never be directly accessible from the web at all (those for storing sessions, file uploads and so on).
    – Fis
    Oct 11, 2019 at 16:45
  • One more add... If there is a process (i.e. autoupdate) which needs a write access to folders accessible from web it must be running under different user account and permissions correctly set on target folders.
    – Fis
    Oct 11, 2019 at 16:52
0

You need to refer to your hosting provider documentation regarding proper permissions as they differ between different companies' set up. A thing that's certain is that setting a folder's permission level to 777 is an insecure way to handle privileges - this means that every user on the system would have access to it.

Within most companies' set up you should have directories to 755 and files to 644

And if you are managing your own server you should't be asking this question at all.

You may refer to the Ubuntu's file permissions documentation page regarding what each column digit means: https://help.ubuntu.com/community/FilePermissions

Permissions are set within the following order:

(u)(g)(o)
owner, group, other (respectively)

Overall the group and other columns should be paid most attention to, as setting them to 7 means that the folder/file would be globally readable and writable by a user belonging to any group or by any user on the system. On a shared hosting configuration this means that any user would be able to edit the other user's data where permissions are set to 777.

Improve this answer
2
  • Using ogu for owner group user is particularly confusing given that chmod (and basically everything else) uses ugo for user group other. Especially since you're using user to mean the opposite of what it normally means.
    – AndrolGenhald
    May 14, 2019 at 13:15
  • @AndrolGenhald you are right, was in a hurry when typing this. I didn't even note what I typed was misleading. Thanks for commenting on this, post was edited.
    – d7x
    May 14, 2019 at 13:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .