2

I have basic understanding of chmod and CentOS file permissions. 777 stands for 111111111 and rwx for each root, group, user, etc. What I can't get my head around is setting up Apache, FTP and PHP to all work together correctly.

I have a proFTPd server and Apache server. How should I setup the permissions on the proFTPd server so that Apache server can read and execute the PHP files? On my initial setup, the files uploaded by FTP cannot be read by Apache. Should I put the FTP user and the apache server into a group?

How does the permission system work (FTP-Apache-PHP) on standard hosting systems?

1
  • These things are not special to CentOS. I'm retagging with the much more general "linux" flag — although actually, they're common to all Unix and Unix-like operating systems.
    – mattdm
    Dec 4, 2010 at 22:30

2 Answers 2

Reset to default
2

Instead of trying to make the ftp work with apache do the other way around which is safest approch.

Using suPHP and suExec will make your apache use the user to make whatever it needs and the ftp already uses the user itself.

Here is how to compile apache with suPHP on centOS: http://markus.revti.com/2010/03/installing-suphp-on-centos-5/

If you have the right repository on your list, you can try to: yum install mod_suphp

Seems rather a simple how-to which i doubt you will have trouble with.

Any questions let me know and i will assist you with what i can.

For more information about suPHP.

For more information about suExec.

2

Apache runs as a specific user (usually httpd) but depending on how it is configured, PHP may run as the same or a different user:

  • If PHP is run as a module, then it will be the same user as Apache.
  • If PHP is run as a CGI (very uncommon) then it will usually run as the same user, unless Apache is configured to use suexec (in which case the user will be in the config).
  • If PHP runs as FastCGI, then it will run as whatever user it has been configured to run as.

This is further complicated by suPHP which is similar to the situation with CGI except that the script is run with uid owning the script file.

The constraints here are that:

  1. The dirs/files writable by the webserver uid (and the PHP uid) should be very limited and where these are writable special consideration should be put into avoiding code injection attacks.

  2. Usually normal users cannot write files as a different uid - and presumably PHP code files need to be maintained (i.e. writable by the users.

Note that whether a PHP file is executable by the webserver has nothing to do with the executable bit on a file (but it has a lot to do with the executable bit on the directory which contains it).

Should I put the FTP user and the apache server into a group?

Probably not. I would recommend treating the webserver/PHP as "other" - so for any content (including PHP) to be accessible by the webserver, the permissions should be:

  • user: read, write
  • group: depends on your policy
  • other read

i.e. 0644 (as above executable permissions are not relevant), and for directories:

  • user: read, write, execute
  • group: depends on your policy
  • other: read, execute

i.e. 0755

You must log in to answer this question.