0

I am a beginner in server management.

I am using the class.upload.php library so that users can upload files from my website. To this, I give a full path like: uploads/gifs/90/x.gif This path does not exist on my server but I want to create it.

My php log returns me: PHP Warning: mkdir (): Permission denied

If on my server as root user I create the uploads folder with 777 permissions, the library creates the rest of the path correctly when uploading a file. User apache owns gifs/90/x.gif

From the above, I believe that the apache user does not have write permissions on the html folder. In etc/groups I have seen that the apache belongs to the group: nagcmd: x: 503: nagios, apache

The web folder on the server has the following permissions: drwxr-xr-x 32 root root 4096 Feb 4 17:20 html

I want the library to be able to automatically create directories in the html folder. What is the best way to do it?

  1. Assign write permissions to others in html /: drwxr-xr-wx 32 root root 4096 Feb 4 17:20 html

  2. Give permissions only to the nagcmd group so that it can write to html/ (I don't know how to do this)

  3. Others

I don't want to compromise the security of the web.

Thank you very much in advance

4
  • 3
    4. Change the owner of html/ to the apache user (which should be called www-data?). Also, chmod 777 is never correct and is a potential security risk.
    – Panki
    Feb 5 '21 at 10:26
  • I advise making the html folder immutable (not-writable). And putting logs in a different location. Feb 5 '21 at 10:50
  • Are you using word-press. It is about the only thing that is still using PHP. Consider more sane solutions: moustache is good. It is well defined (is not full of gotchas), it separates concerns (code logic is separate from template), is easier to use (for both novices, and experts). Feb 5 '21 at 10:53
  • Thanks for the help. In the end I decided to change the owner of the html/ folder and it works fine. Feb 9 '21 at 8:41
1

It will depend on your system. But most likely you have a user and group called www-data, that the server runs as.

You can only change the user if you have capability CAP_CHOWN (you are root). You can add the file to group www-data, but you must ask the admin to add you to this group first.

If you don't have capability CAP_CHOWN, then you can use a file access control list.

setfacl -R -m "g:www-data:rwX" "directory-name"

You may need to enable access-control-list for the file-system. But this is the safest way, as it dose not need elevated privileges (except one-time to enable on FS).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.