permissions, security, and such

tullmejs

Hi, I know how to give permissions to files and folders, but I don't really know to think when doing so, and where to best put different files.

I just moved all but the main php file away from public_html.

main.php does include several php files, that read and write several text files.

Hmm, basically, I can't ask a simple question, I need to be pointed to a good primer on server side site management, explaining permissions and folders and groups in this context.

Thanks!

tullmejs

Hmm, still not understanding exactly what I am doing, I can read and fwrite to a file, but not unlink it!

Isn't that odd?

$current=fopen("/dir/file.txt",w);
fwrite($current,"some string");
fclose($current);

works, but

unlink("/dir/file.txt");

fails. I am so lost :-|

yelvington

Hmm, still not understanding exactly what I am doing, I can read and fwrite to a file, but not unlink it!

Under any Unix-like system:

Reading and write permissions to a FILE are applied to the FILE.

File creation and deletion permissions are applied to the DIRECTORY in which the file resides.

So it is quite possible to encounter the situation you describe.

It also is possible for you to NOT have permission to read or write a file, yet have permission to delete it ... again, the latter permission is applied to the directory, not the file.

tullmejs

I see :-) I eased permissions on the folder to 733, and it works.

So thank you! I still don't really get it all, but I know more now than before, and that's a good thing.

Seems peculiar to grant the "world" writing access, maybe it doesn't matter for folders below public_html level?

I don't manage any sensitive or critical info, but I really must learn some more about this... a couple of my files are owned by Username, others by Nobody. I have no idea why. :-p

yelvington

"Nobody" does not mean nobody in the common sense; "nobody" on your Unix system is a special user account that is used as the standard identity for any number of potential daemon processes. Other Unix systems may be set up to run the httpd daemon as a user named "apache" or "httpd."

When you connect with the server using ftp or ssh or whatever, you log in using YOUR account ID, and any files or directories you create will belong to you.

Here are some resources:

http://www.google.com/search?&q=tutorial%20unix%20file%20permissions

tullmejs

Thanks! Still, one file created by the PHP-script is owned by Username, another by Nobody. I am probably much to tired :-D

Is a script allways "Other", or can it be Group or even User? It would seem fair. I find rather little info on this particular aspect of file permissions, I'll keep looking arund. I also not yet understand the the meaning of the cgi-bin folder...

On the flip side, my page works nicely ;-)