Register Members List Search Today's Posts Mark Forums Read

Reply
 
Thread Tools
  #1  
Old 23 Apr 2010, 03:43
natecoupons natecoupons is offline
 
Join Date: Jul 2008
Question What should my folder permissions be set at?

I have noticed that some of my server folders permissions are set to 755, others are set to 747.

What is the danger in this, and are their exceptions? Should any folder ever be set to 777?
Reply With Quote
  #2  
Old 23 Apr 2010, 08:25
Angel-Wings's Avatar
Angel-Wings Angel-Wings is offline
 
Join Date: Sep 2007
Generally it isn't a good idea to let the same user that runs PHP scripts write anywhere in the webroot so 755 / 777 isn't a good (and safe) idea.
If you still want to store attachments in the filesystem put this directory outside the webroot, chown it the user running PHP and set it to 700.
Maybe a simple example:

/home/www/site/webroot - that's the folder your Webserver is serving

If you run PHP as user "example" and Apache is running under "www" - both group and user - the "webroot" can be set to 550 if example owns it and www is the group.

/home/www/site/uploads - folder where attachments belong - this directory isn't served by your Webserver

Set to 700 if "example" owns this directory.

If you still need to let PHP put files inside the webroot so you've folder left where PHP can write files, you can prevent PHP from parsing scripts there - as example:

<Directory "/home/www/site/webroot/signaturepics">
php_flag Engine Off
</Directory>
Or when running FastCGI removing the Handler.

That's all just in case character filtering isn't done correctly so someone could put an executeable PHP script in your webroot to - well - from dumping your DB to abuse your machine for attacking other sites.

Just a note: changing permission for directories to 550 and to 440 for files may also prevent FTP from storing or changing files so these permissions would need to set back before chaning files through FTP.
Reply With Quote
  #3  
Old 23 Apr 2010, 20:03
natecoupons natecoupons is offline
 
Join Date: Jul 2008
okay does vbulletin have standards of security for folders?

I'd just like a simple list that says:
admincp - 755
archive - 645
clientscript - 747

etc.

I don't want to change any of the permissions because I just know that it will affect something. I also don't want to leave the server open to attack or hacking.
Reply With Quote
  #4  
Old 23 Apr 2010, 20:48
Angel-Wings's Avatar
Angel-Wings Angel-Wings is offline
 
Join Date: Sep 2007
Well - not using archive so unsure about it's permissions but every VB folder is set to 555 here except:

clientscript/vbulletin_css

That's set to 755. In this folder all files are set to 644, the rest of all VB files to 444

It may differ if you let users upload signature images and these are stored in the filesystem - then this folder requires write permission too.

And - some modifications may require write access somewhere
Reply With Quote
  #5  
Old 24 Apr 2010, 19:21
natecoupons natecoupons is offline
 
Join Date: Jul 2008
Hmmmm well this evening ill start changing my permissions. I need to really secure our server after an incident.
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 02:15.

Layout Options | Width: Wide Color: