Permission for PHP scripts on a Commercial *nix Server

Permission denied on some servers

[Guardian]

Hi

I am the author of <snip>my software</snip>. Some of <snip>my software</snip> users are experiencing difficulties with file permissions on commercial *nix systems during installation.

I have been running <snip>my software</snip> on my own server (Apache2/win/php5) without problems. I have also installed it on a personal Linux OS without problems but never done so on a commercial one.

Info:
- The entire script reside in ONE directory /directory and it does not require access to any other directories.
- <snip>my software</snip> does not use a database
- During the installation, and later on, scripts automatically creates a number of files and directories, all within the same /directory directory.

I have had users who have installed it on nix servers with 755 for the /directory and 644 for the individual php scripts as expected.

Then, there are others who have to set the permission for /directory to 777 or else it would not be able to create the directories.

Setting permission to 777 is not a favourite choice.

I presume that whether PHP is installed as CGI or Module may have a bearing on the matter.

Can anyone advise me, so that I can advise others, the best and proper permissions to set?

I would be really grateful if someone would actually go through the process and write a quick step-by-step guide for the users.

Many thanks indeed

AZ
<snipped url>

[edited by: coopster at 8:47 pm (utc) on Sep. 23, 2004]
[edit reason] no urls as per TOS [webmasterworld.com] [/edit]

[encyclo]

Apache has just got to have write access to the directory to be able to create those files. Dependent on the configuration, Apache could be running as user "apache", or "nobody" (or pretty much anything), whereas in a shared hosting environment, the files and directories are owned by the user.

I'm seriously concerned about your design choices with your script. Because users with FTP only access to a shared server can't chown a directory, they are going to be forced to chmod 777. I think it's a very bad idea to have the content/user files generated in the directory where the script is located, because it would risk leaving all your script files world-writeable - which is a security hole large enough to drive a bus through.

You need to have all user-created files in a completely separate directory, ideally outside of the document root. That would at least mean that your script files remain safe in a directory with proper permissions even if the user directory has to be chmod 777.

[jollymcfats]

The directories must be writable by the web server user, typically "nobody" or "apache", with group "nobody", "nogroup" or "apache".

Usually in hosting environments, a user's directories will be owned by the user's account with a group of either "users" or a group private to the user's account.

Chmod 777 will let the web server user write, but everyone else too. Best bet is to

chgrp

the directory to the web server group, but

chgrp

is probably locked down on lots of hosts.

Given that the web server user can be different everywhere, the best advice is probably to tell people to contact their help desk to make the directories writable by the web server process.

[Guardian]

Thank you encyclo and jollymcfats.

That is the dilemma.
In a hosting environment, how would the user be able to store their files outside their assigned directory?

The layout at the moment is (as an example)

/bbs
/bbs/index.php
/bbs/azbb.php
/bbs/post.php
/bbs/conf.php
/bbs/center (scripts,images,etc)

/bbs/data_dirx
/bbs/data_dirx
/bbs/data_dirx
/bbs/data_dirx

The above data directories are created on installation and azbb needs to have write permission to these directories.

How would I go about improving the set up?

TIA

PS. What about including empty directories in the installtion zip (instead of the script creating them) and advising users to chmod those directories to 777 and leave the rest as 755 or even 644?
?!

[Guardian]

I can't edit my previous post, so here is some extra info:

/bbs
/bbs/index.php --> read/exec
/bbs/azbb.php --> read/exec
/bbs/post.php --> read/exec

/bbs/conf.php --> read/write and exec? (only varaiables in the conf.php)

/bbs/center (scripts,images,etc) --> read/exec? (they are all being included in above index/azbb/post.php Do they need exec permission?)

/bbs/data_dirx --> read/write
/bbs/data_dirx --> read/write
/bbs/data_dirx --> read/write
/bbs/data_dirx --> read/write

Thanks for the help
:)

[jollymcfats]

PHP files don't need exec permission on Unix. Just the directories.

As far as doing the right chmoding & directory creation at installation time, you might take a look at how the Gallery photo album install process works. They've got a good system.

[encyclo]

Basically, you've got to think of the overall structure within the context of a shared hosting environment. Such environments naturally vary, so you need to have the flexibility to adapt to those differences.

In a fairly standard shared hosting environment, a user is given their own local account on the server, with a home directory and access via FTP and sometimes via SSH (without root access). Their home directory may be created something like this:

/home/username

In their home directory, there is a directory for the website:

/home/username/public_html

The public_html directory is the document root for http access.

What you want to make sure is that you can create no files or directories within the directory your script resides.

Using the above example, your script would be here:

/home/username/public_html/bbs

Option 1: the quick fix

Put all the data files in a directory within your bbs directory:

/home/username/public_html/bbs/[b]data[/b]

The user can chmod the "data" directory as 777, but the "bbs" directory remains as 755. Create all the files and directories you need inside the "data" directory.

Option 2: the secure way

You need to make the location of your new data directory variable, and placed outside the document root is possible. During the installation process, the user can specify the directory location, and your script can keep that in a configuration file.

In my above example of a shared hosting environment, the user could therefore place the "data" directory directly in his home directory, so it would not be accessible directly via http, but it would be accessible for your PHP script:

/home/username/[b]data[/b]

Ideally again, the user could chown nobody:noboby (or whatever the user Apache runs under) that data directory, so that only the Apache process can write the files, not anybody with access to a shell account on the server (which is why chmod 777 is fundamentally insecure).

Some server environments don't have any space outside the document root, so in that case you would have to place the "data" directory elsewhere. However, giving the choice during the installation process of placing the data directory anywhere, at least you get some security by obscurity (which is better than nothing).

The only time you need to have write access to anything in your script directory would be during installation - so you would need to tell your users to chmod 666 the configuration file in their FTP client for the duration of the install process, but then you should check that the file is changed back to 644 or similar before the script will run.

[Guardian]

Thank you jollymcfats and encyclo.

I am making changes to the install process. I am including all the directories in the zip so there would not be any need for the script to create directories.

This is the real structure of the bbs script:

I appreciate your advise on the permissions and layout.

/bbs 755
/bbs/index.php 644 (main php script)
/bbs/azbb.php 644 (main php script)
/bbs/post.php 644 (main php script)

/bbs/conf.php 777 (writeable via Admin panel)

/bbs/bb_center 755 
/bbs/bb_center/flag 755 (used in HTML)
/bbs/bb_center/skin 755 (used in HTML - has sub-dir)

/bbs/bb_center/language 755 (used by script)
/bbs/bb_center/source 755 (location of the scripts, included in 'main php script')

writeable
---------------
/bbs/avatar 777 (used in HTML)
/bbs/vi 777 (used in HTML)

/bbs/data 777
/bbs/attachment 777 (read by script only)
/bbs/data_member 777
/bbs/data_topic 777
/bbs/data_pm 777 

TIA

PS. I posted the same question to 3 forums and Webmaster World is the ONLY forum who has replied. Thumbs up to Webmaster World