Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place. |
Notices |
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
Are you new to LinuxQuestions.org? Visit the following links:
Site Howto |
Site FAQ |
Sitemap |
Register Now
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
|
|
03-02-2003, 01:52 AM
|
#1
|
Member
Registered: Apr 2002
Location: New York City
Distribution: Debian
Posts: 30
Rep:
|
'Proper' file and directory permissions
I noticed today that my debian installation has set all the directories off of / to 755. Is this good? Any user of my system is able to FTP in and download almost anything. I'd like to change this, but I'm not sure what programs need these permissions, if any.
Also, I'm using apache and "public_html" home directories in the user accounts which have to be set to 701 for the web server to be able to view them and the files have to be at least 604, I think, but this also enables any other user to enter another user's public_html directory and download files if they know the file name. Is there a way to avoid this?
|
|
|
03-02-2003, 01:55 AM
|
#2
|
Senior Member
Registered: Nov 2002
Location: British Columbia, Canada
Distribution: Gentoo x86_64; FreeBSD; OS X
Posts: 3,762
Rep:
|
755 permission with a directory just means that non-root people can enter the directory and ls the contents. The permission of the file itself dictates whether they can read/delete/edit/execute it.
|
|
|
03-02-2003, 02:05 AM
|
#3
|
Member
Registered: Apr 2002
Location: New York City
Distribution: Debian
Posts: 30
Original Poster
Rep:
|
I understand how directory and file permissions work - what I'm saying is the files themselves are set to readable as well. What I don't know is if they have to be set this way for daemons and other processes to read them. For instance my /etc/passwd file is 644.
As far as the web files are concerned, they do have to be readable so that the web server can read them, but it seems this means any other user can through the file system as well.
|
|
|
03-02-2003, 02:07 AM
|
#4
|
LQ Guru
Registered: Jan 2001
Posts: 24,149
|
Anyone setup for FTP, you can look into chroot.
This will jail them into whatever is their default home FTP directory, making it so they can't browse any other part of your filesystem.
|
|
|
03-02-2003, 02:10 AM
|
#5
|
Member
Registered: May 2002
Location: AK - The last frontier.
Distribution: Red Hat 8.0, Slackware 8.1, Knoppix 3.7, Lunar 1.3, Sorcerer
Posts: 771
Rep:
|
The way I would do this is create a group, add the webserver user ( nobody, if you're running apache out of the box ) to that group. chgrp the files that need to be access controlled to that group. Now change permissions on the folders to 750 and files to 640. I'm assuming that the users here own their files, so they get their permissions from the 'owner' set of permissions.
|
|
|
03-02-2003, 04:24 AM
|
#6
|
Member
Registered: Apr 2002
Location: New York City
Distribution: Debian
Posts: 30
Original Poster
Rep:
|
Thanks, I'll try the group thing. The apache user is www-data, I think.
|
|
|
All times are GMT -5. The time now is 02:58 PM.
|
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
|
Latest Threads
LQ News
|
|