1

My hoster placed a .user.ini in my public_html. What is the recommended file permission be? Now it's 644.

2
  • What's it for? Who needs access? etc. etc. You set the permissions based on a "least privilege/need to know" model. – schroeder May 6 '20 at 11:09
  • Is this a hosting with cPanel? – Esa Jokinen May 6 '20 at 12:10
0

The PHP .user.ini file:

Since PHP 5.3.0, PHP includes support for configuration INI files on a per-directory basis. These files are processed only by the CGI/FastCGI SAPI. This functionality obsoletes the PECL htscanner extension. If you are running PHP as Apache module, use .htaccess files for the same effect.

It doesn't seem quite recommendable per se to allow such files that enables changing PHP settings with same privileges that are used by a web application, although the possible php.ini directives are limited:

Only INI settings with the modes PHP_INI_PERDIR and PHP_INI_USER will be recognized in .user.ini-style INI files.

As the file is inside the document root, it's recommended to limit the access to it from the web i.e. you shouldn't be able to access it using http://example.com/.user.ini type URLs. You should check that. The required Apache configuration would be:

<Files ".user.ini"> 
    Require all denied
</Files>

The file permissions doesn't affect this that much, as it would be probably accessed using the user's own account. However, with 644 everyone having local access to the server can read this configuration file.


If this is a cPanel hosting, there's interesting details about their implementation on cPanel forum: custom .user.ini files with FastCGI:

If you want the file to be unreadable, make it 0400 (or 0600). Here is a quote from one of our developers that better explains this:

This behavior is by design. Since the file is readable by all users, it is readable by the user in question. When saving files, to avoid problems when the user is over quota, we write to a temporary file, and if that was successful, rename(2) the file into place. Since the user has write permission in this directory, the rename is successful and the old file, along with its permissions, is destroyed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.