World Readable PHP Files with Apache

[Anon]

I'm new to PHP/MySQL/Apache. What I want to know is: how do I avoid world readable files?

So, here's the scenario in detail:

• I have a MySQL database. I have one user in the database that is restricted to reading the database, and another that is an "administrator" user

• Certain PHP files on the web site I am coding use the "guest" user to do the main part of the site - generating dynamic pages, etc.

• The "administrator" user is used to do such things as add new entries to the database and change existing entries. This user is used by other PHP files.

• Apache is running under the username 'nobody'

• The PHP files are owned by root

• This means the files must be world readable, right?

• If the files are world readable, it also means that anyone that has a shell account on the host machine can read them

• If a random user reads the correct file, that means that they can determine the administrator account's username and password, correct?

• That's bad.

Let's say that I can't change the owner of the files from root to nobody. How could I avoid world-readable files that could potentially compromise the security of the database?

[[deleted]]

"Let's say that I can't change the owner of the files from root to nobody. How could I avoid world-readable files that could potentially compromise the security of the database?"

Can you change the group-onwership of the file?
If so, you can take the "world readable" off the files, and
instead make them group-readable and change the group-ownership of the files to the group that the webserver-user is in.

Note: running as user "nobody" is not a good idea for a webserver.

2nd Note: Files that are accessible by a webserver should never EVER be owned by root.