2

My hoster placed a .user.ini in my public_html. What is the recommended file permission be? Now it's 644.

2
  • What's it for? Who needs access? etc. etc. You set the permissions based on a "least privilege/need to know" model.
    – schroeder
    Commented May 6, 2020 at 11:09
  • Is this a hosting with cPanel? Commented May 6, 2020 at 12:10

2 Answers 2

2

The PHP .user.ini file:

Since PHP 5.3.0, PHP includes support for configuration INI files on a per-directory basis. These files are processed only by the CGI/FastCGI SAPI. This functionality obsoletes the PECL htscanner extension. If you are running PHP as Apache module, use .htaccess files for the same effect.

It doesn't seem quite recommendable per se to allow such files that enables changing PHP settings with same privileges that are used by a web application, although the possible php.ini directives are limited:

Only INI settings with the modes PHP_INI_PERDIR and PHP_INI_USER will be recognized in .user.ini-style INI files.

As the file is inside the document root, it's recommended to limit the access to it from the web i.e. you shouldn't be able to access it using http://example.com/.user.ini type URLs. You should check that. The required Apache configuration would be:

<Files ".user.ini"> 
    Require all denied
</Files>

The file permissions doesn't affect this that much, as it would be probably accessed using the user's own account. However, with 644 everyone having local access to the server can read this configuration file.


If this is a cPanel hosting, there's interesting details about their implementation on cPanel forum: custom .user.ini files with FastCGI:

If you want the file to be unreadable, make it 0400 (or 0600). Here is a quote from one of our developers that better explains this:

This behavior is by design. Since the file is readable by all users, it is readable by the user in question. When saving files, to avoid problems when the user is over quota, we write to a temporary file, and if that was successful, rename(2) the file into place. Since the user has write permission in this directory, the rename is successful and the old file, along with its permissions, is destroyed.

0

I found this useful, if you don't want the owner of the site to have access to the file, to see the contents, change the contents, or remove the file

chown root:apache .user.ini, or chown apache:apache .user.ini
chmod 440 .user.ini, or chmod 640 .user.ini
chattr +i .user.ini

The chattr +i is great, it even prevents root from accidentally doing anything to this file, without doing a chattr -i first.

-r--r-----   root  apache .user.ini
lsattr .user.ini
----i----------------- .user.ini

What I have not found yet is how to prevent this file from being created/used in any subdirectory.

Definitely put this in your httpd config file

<Files ".user.ini"> 
    Require all denied
</Files>

to prevent apache from returning this file to browsers.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .