My PHP application and all the files are owned by www-data however I am currently logged in to the server using my username ruser. I'm developing on the same machine so everytime I want to test changes to my php code I have to go back and forth between file owners.
Is this the best practice or is there a different way I can set this up to make my development smoother?
Make your user part of the www-data group, or make the www-data user part of your group. Then give group access to your files:
usermod -a -G www-data yourusername
In terms of best practice, you should be developing on a different machine anyway. Then deploy your code and use scripts to set up whatever secure configuration is right for your project.
There are a few options open to you.
1) You can change all the files to the www-data group while keeping them owned by you
from your site's root directory run:
chmod -R ruser:www-data ./*
2) The best method is to set up an ACL if your distribution supports it: http://bit.ly/Lat25d
3) Or the simplest method (on a dev machine only - don't do this on a live server) is to chmod everything to 777 from the site's root directory
chmod -R 777 ./*
You can change the files to be owned by any user, i.e use the following command: chown username:groupname file.php
Only require Apache to own the files if Apache is going to write to the files or overwrite the files.
So change the ownership to the FTP user to avoid constant ownership changes.
Related
i'm hosting a simple php Script wich create folders and upload images , it has a simple admin page (serverip/admin) .
i tested the scripts in my local server and it works perfectly , but in my server it doesnt and i believe its a permissions issue .
my /var/www/ folder permissions :
root#WallApi:/var/www/html# ls -l
total 8
-rw-r--r-- 1 root root 1 Jul 13 00:56 index.php
drwxr-xr-x 7 root root 4096 Jul 13 00:55 Script
root#WallApi:/var/www/html#
i have no group users i simply want to be able to upload / create etc using the script
if you are using LAMP you should change the permission owner to apache user or change permission to 777.
1) Change owner
chown -R apache:apache /var/www/html
2) Change perssmion ( not recommend)
chmod -R 777 /var/www/html
p/s update
The permissions on this folder are:
chmod 755 /var/www/
and the files inside the folder are:
chmod 644 /var/www/file
The default permission for /var/www itself is a pretty standard one: owner root:root and mod 755.
As for anything inside /var/www, that is one of the rare directories where you have the privilege of deciding for yourself what to put in it and what permissions everything in it should have. But what makes the most sense is:
Most files should be writable by whichever user or group is going to be writing to them most. You can set them to be owned by your user account. Or set up a custom group for your developers. Or if the files will be modified rarely and you want good security, you can go with root:root and just sudo in on the rare occasions they'll be modified.
Most files should not be world-writable. So, 644 for files, and 755 for directories is appropriate (or 664 and 775 if you want to give a group write access).
It is not recommended to set any of it to be writable by the web server, ie www-data, except for any specific files your web scripts to be able to write to. If so, it's better to set the user or group of those files to www-data than to make them world-writable. Note that any time the www-data user can write to any file within the web root, whether it's by setting the user or group on those files, or making them world-writable, it's a potential security problem. World-writable is just the worse of the two.
I have a PHP script application installed on a cloud server.
One of the function is the "PDF Preview", which is currently not working properly.
I contacted the PHP script owner, and he asked me to make sure:
1. dompdf/lib/font/ folder has write permissions (777)
2. the owner of the folder is the Apache user (mostly it is www-data)
For the 1st one, I tried to change the directory permission directly in the FileZilla interface. But it always changes back to 775 after I refresh...
For the 2nd one, I have no idea what it means... I contacted the technical support of my cloud server service. He said it's an App related issue, not server.
Can anyway give me some direction please? Should I use SSH? or anything else?
Really appreciated your help...
Erin
If you have SSH access, it is easier.
1) SSH in and CD into your web directory (likely public_html)
2) run the command chmod -R 777 dompdf/lib/font/
However permission 755 is likely fine...
3) Run ls -l. It will likely look like this:
-rw-r--r-- 1 erin erin 395 Aug 21 2013 index.php
The first 'erin' is the user and the second 'erin' is the group.
There may be other files that have the correct group (such as www or apache). Try and match other files in the public_html directory:
To change the owner: chown apache dompdf/lib/font/
To change the group: chgrp apache dompdf/lib/font/
If you're on shared hosting you might not have access to do this. I'm guessing it's more likely a path or configuration issue than a permissions issue, but give this a shot.
As far as I know you cannot change the owner of a file/directory via FTP. You can via SSH.
The command to change file permissions:
chmod 777 filename.php
To change a directory's permissions:
chmod -R 777 dirname/
To change the owner of a file:
chown www-data filename.php
To change the owner of a directory:
chown -R www-data dirname/
To change the group of a file:
chgrp www-data filename.php
To change the group of a directory:
chgrp -R www-data dirname/
Make sure you are in the file's directory when changing file permissions and ownership with the above commands. Otherwise you'll have to update the path.
If you are updating directories, be sure to be above the directory you wish to update.
Hope this helps.
P. S. To view the current permissions / owner / group of a file or directory, use the ls -la command.
Do not use the database user as the UNIX user. Use www-data.
sudo chown -R www-data:www-data /var/www
There is a difference between the database user and the Apache user. The Apache User is the only one who can actually read the files. The database user is only meant for giving/taking database read/write permissions.
In addition, keep the default permissions from the webapp install. Do not change those, except for the owning user/group. If you are instructed by the webapp, change permissions.
If you are more concerned about security, you could instead run the following commands:
sudo chown -R $USER:www-data /var/www
sudo chmod -R 640 /var/www
This makes the actual files owned by your user, so that only you (and root) can modify them. The reason www-data is referenced is so that Apache can still READ the files, but not actually write to them.
The 640 allows you (the file owner) to read and write, while allowing the www-data group to read files. It also blocks anyone else from possibly reading the file contents.
(The above is only one possible (untested) method. More good ways are available here.)
My PHP runs "exec" under the user "www-data"
my git repository is owned by "admin"
so it cannot access.
If I change ownership to "www-data" it passes the access problem but I can't create SSH keys because www-data is not a "real" user. I don't even know what that is. where is the home folder for such user?
also, when i change the ownership to "www-data" I cannot use git as admin on that machine anymore. gives me error: cannot open .git/FETCH_HEAD: Permission denied
Where is the home fold for user www-data ?
how can I get it to be able to use git with SSH keys set up?
Transferring ownership to www-data is the right decision. I mean www-data is indeed the owner and since it needs full read/write permissions to that folder anyway - do it!.
The following information is at least true for Debian based systems
www-data is a real user. Also it has a home dir. You can find it using:
cat /etc/passwd | awk -F: '/www-data/{print $6}'
On Debian/Ubuntu it is /var/www for example.
To make the github access possible you can create keys for www-data and place them in /var/www/.ssh. !!!Make sure that this folder is not accessible from web!!!. Then create a machine-user on github add use the public key for www-data.
Creating the keys:
sudo -u www-data ssh-keygen -t rsa
Once you are finished, create a new user on github, name it your-app-machine-user (or whatever), copy /var/www/.ssh/id_rsa.puband add it to that github account.
Read access for www-data should work now.
Try: chown -R www-data:www-data .git/
I'm real new to Mac and Apache. I my development machine my website cannot access any files under the web roots /images or /css folders.
The apache log gives the following error:
(13)Permission denied: file permissions deny server access:
The site is hosted up under the 'Sites' folder. I checked in 'Get Info' on this folder and it seems that 'Everyone' has read access. What gives?
Thanks!
The problem is that Apache runs with a user different to the user owner of files, and the Apache's user doesn't have read/write/execute permissions. In my case the user was _www and is member of the _www group.
I solved this issue changing the group of the files to the _www:
Look for the apache's user and group. I used this php script:
<?php
echo exec('whoami') . '<br>';
echo exec('groups') . '<br>';
?>
Login with the user owner of the files.
Add the user owner of files to the _www group.
$ sudo dseditgroup -o edit -a userOwnerOfFiles -t user _www
Change the group of files needed to _www
$ chgrp -R _www path/containing/files
Change file permissions for the group
$ chmod -R g+rwx path/containing/files
This was a tough one for me today. It turned out that I needed to give permissions to the web server to the entire directory tree all the way up to the doc root.
It came up for me today because I'm using a virtual host and storing the files pretty far up a tree in my user directory.
I did not want to recursively change all the thousands of files in my Documents directory so I just chmod ed each folder in the path. In my home directory:
$ chmod 755 Documents
$ chmod 755 Documents/projects
$ chmod 755 Documents/projects/dev
$ chmod 755 Documents/projects/dev/someglamorousclientname/
$ chmod 755 Documents/projects/dev/someglamorousclientname/docroot
Another alternative way of solving this is using extended attributes in MacOSX
chmod +a "_www allow list,read,search,readattr,readsecurity,file_inherit,directory_inherit" /path/to/document_root
I've found 2 things did the trick for me (I was specifically trying to get apache to have access to the Downloads folder):
In System Preferences -> Security & Privacy -> Privacy scroll to Full Disk Access on the left, make sure you unlock at bottom, and then click the + to add an app. Navigate to /usr/sbin and find the executable httpd and add that, making sure it has full disk access enabled. Re-lock the preferences
Right click the particular folder in Finder and choose Get Info, then under Sharing & Permissions, allow access for the "everyone" user (or if you are trying to be more security conscious, perhaps only allow for "_www" user - but I did not test this).
That solved it for me
This method is safe & fast to test, and easy to switch back if it's not working (it won't mess up things even more, which is ofter a problem when fixing these kind of issues:
Locate httpd.conf (you can do it with httpd -V in terminal)
Open this file in Brackets or any text editor
In this file, find:
User _www
Group _www
Change it to
User {your username}
Group staff
Maybe you will have to add something else to your User and Group:
In this httpd.conf file, you can also find a path to your webserver, just search for DocumentRoot. Copy this path, and navigate to it in terminal with cd command, for example: cd /Library/WebServer/Documents
When you are in, do a ls -l. This will give you info about webroot folder ownership. Adjust your User and Group in the httpd.conf regarding this
You can also enter the webroot folder and check the sites ownerships as well with ls -l, and update httpd.conf regarding that.
If this is not working, don't forget to switch back to:
User _www
Group _www
I'm trying to implement Mercurial to use to manage my personal websites. Here's my current setup...
I have a repository on Bitbucket
I cloned the repo to my home PC for development
I cloned the repo to my web server (Hostgator VPS) for deployment
My problem is that I can only execute "hg pull" (or any other commands) on the web as the root user. I can't su or sudo to the actual user on the web server that the account belongs to.
As a result, all files are created on my server with the user/group as 'root', and the server throws an internal server error when trying to load those files. I can use 'chown' to change the user/group on the files, and get them working. However, doing an 'hg pull' fails to copy down the changed files. It seems as though it won't overwrite the files after the owner has been changed.
Any suggestions on what to do?
This is usually handled using a group and the group sticky bit.
For example create a group 'dev' and add both 'root' (really, they make you login as root?!) and 'apache' (where apache may actually by wwwrun or www, etc) to it:
% groupadd dev
% usermod --add-to-group dev root
% usermod --add-to-group dev apache
Then chgrp all the files over to that group:
% chgrp -R dev /path/to/repos
Then make sure all group members can read and write those file:
% chmod -R g+rwx /path/to/repos
The make sure any newly created files are automatically in that group:
% find /path/to/repos -type d -print0 | xargs -0 chmod g+s
Then any new files created by apache will be owned by the 'dev' group which both it and root can read. Root will need to make sure the files it creates from the command line had read/write permissions for group too.
Note: Doing anything like this with root is unsafe -- use a dedicated account whenever possible, I always create 'hg'.
This is explained here in the Mercurial wiki.