Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have basic understanding of chmod and CentOS file permissions. 777 stands for 111111111 and rwx for each root, group, user, etc. What I can't get my head around is setting up Apache, FTP and PHP to all work together correctly.

I have a proFTPd server and Apache server. How should I setup the permissions on the proFTPd server so that Apache server can read and execute the PHP files? On my initial setup, the files uploaded by FTP cannot be read by Apache. Should I put the FTP user and the apache server into a group?

How does the permission system work (FTP-Apache-PHP) on standard hosting systems?

share|improve this question
    
These things are not special to CentOS. I'm retagging with the much more general "linux" flag — although actually, they're common to all Unix and Unix-like operating systems. –  mattdm Dec 4 '10 at 22:30
add comment

migrated from serverfault.com Jan 31 '12 at 20:34

This question came from our site for professional system and network administrators.

2 Answers

Instead of trying to make the ftp work with apache do the other way around which is safest approch.

Using suPHP and suExec will make your apache use the user to make whatever it needs and the ftp already uses the user itself.

Here is how to compile apache with suPHP on centOS: http://markus.revti.com/2010/03/installing-suphp-on-centos-5/

If you have the right repository on your list, you can try to: yum install mod_suphp

Seems rather a simple how-to which i doubt you will have trouble with.

Any questions let me know and i will assist you with what i can.

For more information about suPHP.

For more information about suExec.

share|improve this answer
add comment

Apache runs as a specific user (usually httpd) but depending on how it is configured, PHP may run as the same or a different user:

If php is run as a module, then it will be the same user as Apache If php is run as a CGI (very uncommon) then it will usualy run as the same user unless Apache is configured to use suexec (in which case the user will be in the config) If php runs as FastCGI, then it will run as whatever user it has been configured to run as.

This is further complicated by suPHP which is similar to the situation with CGI except that the script is run with uid owning the script file.

The constraints here are that:

  1. The dirs/files writable by the webserver uid (and the PHP uid) should be very limited and where these are writable special consideration should be put into avoiding code injection attacks

  2. Usually normal users cannot write files as a different uid - and presumably PHP code files need to be maintained (i.e. writable by the users.

Note that whether a php file is executable by the webserver has nothnig to do with the executable bit on a file (but it has a lot to do with the executable bit on the directory which contains it).

Should I put the FTP user and the apache server into a group?

Probably not. I would recommend treating the webserver/php as "other" - so for any content (including php) to be accessible by the webserver, the permissions should be:

user: read, write group: depends on your policy other read

e.g. 0644

(as above executable permissions are not relevant)

and for directories: suer: read, write, execute group: depends on your policy other: read, execute

e.g. 0755

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.