File permissions and Group?

[janton]

Hey All,

I understand how file permissions work but i don't seem to understand how to correctly configure the Owner/Group.

When i upload files to my server with ftp the username is used for Owner AND Group. So i installed Drupal and want to set al file permissions correct. The problem is i now need to set some directories to 777 because Owner or Group is not apache (i guess).

Here below how drupal describes: (http://drupal.org/node/244924)
-------------------
(I'm assuming that greg user is part of greg group and that greg is the site owner)
[root@localhost]cd /path_to_drupal_installation
[root@localhost]chown -R greg:www-data .
[root@localhost]find . -type d -exec chmod u=rwx,g=rx,o= {} \;
[root@localhost]find . -type f -exec chmod u=rw,g=r,o= {} \;


[root@localhost]cd /path_to_drupal_installation/sites
[root@localhost]find . -type d -name files -exec chmod ug=rwx,o= '{}' \;
[root@localhost]find . -name files -type d -exec find '{}' -type f \; | while read FILE; do chmod ug=rw,o= "$FILE"; done
[root@localhost]find . -name files -type d -exec find '{}' -type d \; | while read DIR; do chmod ug=rwx,o= "$DIR"; done
--------------------



So i now changed Group from username to apache, is this correct>secure?
(but Owner of the directory or file is still username)

It seems to work because i now can set directory to 775 and not the insecure 777, when i look in the directory i see files created with the Owner/Group apache.
And now when i upload new files with ftp i need to change the Group all the time, this doesn't seem to be normal? (i guess only if i need to give it write access)

 

[SeLLeRoNe]

is not secure at all.

I suggest you to search in this forum for mod_ruid2 and install it so you will not need to change permission to 777 and neither to change file/directory owner.

Regards

 

[janton]

is not secure at all.

I suggest you to search in this forum for mod_ruid2 and install it so you will not need to change permission to 777 and neither to change file/directory owner.

Regards

Aaa! nice program, i just started reading but i like it! it's exact what i was looking for... only why is it not save like i now have 775 with apache group.. that is not save because...? this way apache could be hacked? i just added you to msn.. you never know

 

[SeLLeRoNe]

yes, cause with apache group owner on file will be a high-risk on server-wide.

mod_ruid2 will start each apache istance directly as user, so, the hacked user will have access just to that user directories and not to all system, and, will be easier to find out the user that use much resource.

Regards

 

[janton]

yes, cause with apache group owner on file will be a high-risk on server-wide.

mod_ruid2 will start each apache istance directly as user, so, the hacked user will have access just to that user directories and not to all system, and, will be easier to find out the user that use much resource.

Regards

Ok so it´s handy if you have multiple domains, but if you have 1 site on your server you don´t need this right? or does apache also have more access to the "total" system.

 

[SeLLeRoNe]

with risk permission as 777 all the system is at risk.

Is needed, no matter how many domains.

Well, this is my own opinion but i think many other will agree with me.

Regards