Solved

Linux permissions in the context of web sites

Posted on 2016-09-26
9
178 Views
Last Modified: 2016-09-27
Hi:
I have read and reread a number of articles on permissions and know how to change them, yet I find that I cannot place them in the context of web site development and usage. I do not have access to the server directly since I use a remote Linux shared server.

As the only developer, I am creating a web site with PHP. I need to create directories and files which I transfer through an FTP app on my desktop. All of the web site scripts and data files are in the URL-accessible server directories, except the uploads directory that is private (between the URL-accessible web directory and the root directory).
Directory structure:
/
-private directory (Non-URL accessible - for uploads)/
    -files
    -sub-directory/
        -files
-web directory (URL accessible)/
    -sub-directory/
        -files
        -sub-sub-directory/
            -files

Open in new window

There are three types of user:
1. The only developer, where I create directories and files, use the web site app, upload image files from the web site and the FTP app, and manage the directories and files through FTP.
2. The web site user, who uses the web site forms and reads data on the web pages. They may not upload any files. They have no personal access to the directories and files.
3. Specific web site users, that is registered members, are like user 2. except they may upload image files to the server.

What is an permission 'owner'? Me as developer, the server, or the scripts?
What is a 'group'? Me as a developer, only other developers if there were some, registered members?
And is 'other' the regular non-registered users - ie anybody using the app?

For each of these groups 1 through 3, what would be the rwx permissions for the directories and files that they have access to?
If another developer joins me and I want to have secure directories and files that this second developer must not have, how would this change the permissions?

Much appreciated :)
0
Comment
Question by:krotb
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
9 Comments
 
LVL 83

Assisted Solution

by:Dave Baldwin
Dave Baldwin earned 500 total points
ID: 41817407
Normally with shared hosting you set the permissions thru the FTP account.  You are normally the owner.  There are no other users on the server except for 'root' which you do not have access to and the web server user which is a very limited user.  For any other limits on access, you will have to create those in your code.

To get more actual Linux users for finer control over the file permissions, you would have to get your own server.  I have not seen any shared hosting that will allow that.
0
 

Author Comment

by:krotb
ID: 41817819
So does this mean that all my directories and files should have group and other as --- ? Including upload directories and files?
0
 
LVL 83

Accepted Solution

by:
Dave Baldwin earned 500 total points
ID: 41818146
No.  If you did that no one would be able to access them thru the web server.  Using my own site as an example, 'normal' file permissions are -rw--r--r (644) which allows you to write files and others to read them.  Directories must have the 'x' bit set as shown in the image below.
Linux permissions
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:krotb
ID: 41818501
Ah! Great.
Just to clarify ..
If my users need to upload images, which would be writing to the server, would that mean assigning rw-  to the 'upload' directory and file under 'group' or 'other' or neither?
0
 
LVL 83

Assisted Solution

by:Dave Baldwin
Dave Baldwin earned 500 total points
ID: 41818522
Users upload files to a PHP script, not directly to a directory.  Writing to the final directory is normally done by enabling 'suexec' on the server.  That allows your PHP scripts to write uploaded files to the required directories under your permissions.  

On shared hosting, 'group' is almost useless.  'World' or 'other' is what web site visitors are under and it is almost Never a good idea to enable them to directly write anything.  Most of the time there is no way for them to do it anyway.
0
 

Author Comment

by:krotb
ID: 41818531
.. the directory with x as well, of course.
0
 

Author Comment

by:krotb
ID: 41818534
Great! Thanks Dave.
0
 

Author Closing Comment

by:krotb
ID: 41818595
Dave, that's the best explanation I've ever read. Thank you.
0
 
LVL 83

Expert Comment

by:Dave Baldwin
ID: 41818614
You're welcome, glad to help.
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Help with mod_substitute 18 37
php subtract from date 2 28
deprecated mysql extensions 1 25
Delete image(s) associated with record(s) 16 26
Password hashing is better than message digests or encryption, and you should be using it instead of message digests or encryption.  Find out why and how in this article, which supplements the original article on PHP Client Registration, Login, Logo…
Nothing in an HTTP request can be trusted, including HTTP headers and form data.  A form token is a tool that can be used to guard against request forgeries (CSRF).  This article shows an improved approach to form tokens, making it more difficult to…
Learn how to match and substitute tagged data using PHP regular expressions. Demonstrated on Windows 7, but also applies to other operating systems. Demonstrated technique applies to PHP (all versions) and Firefox, but very similar techniques will w…
The viewer will learn how to look for a specific file type in a local or remote server directory using PHP.

756 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question