Question

could any one explain how permission levels work when a Client connects to a webpage of my server?

Specifically:

I create a folder in the apache root directory that is owned by Root, So I can read write and execute with a root user.

When a webclient connects to this server, what is the user level of this webclient? Is it Nobody? Basically what im getting at is I want to create say a cron folder in my apache root, but I dont want web clients getting into it.

Aside the fact that I should “stick it outside of the webroot” – Is this possible to create a folder that is not browseable by a user through a web browser through file permissions alone?

Another thing I dont get… When a php script is running inside apache.. what user is running that script? – I commonly see allot of talk about chmod’ing a php file to 664 or something along those lines for security… but surely… you want that script to run anyway – or else you wouldnt of made it otherwise.

I know this is kind of 2 questions… my understanding of permissions from a web point of view is kind of confused… I get it from a Linux standpoint, but as soon as it goes web.. I get confused.

Maybe just an overview of permission with regards to apache and scripts… I dont need a deep understanding – just enough to be able to do things the safe correct way. Maybe an example of why you would change a scripts permissions or owner in the apache root?

Cheers all you super smart guys!

Answer 1

Generally speaking, Apache (which is the httpd server which executes PHP, when answering HTTP requests) runs with a user which doesn’t have much privileges.

This user is generally called either www-data or nobody, depending on your Linux distribution.

If you want a directory that cannot be accessed by that user, and can be accessed by root, a possibility would be to make sure that :

• This directory belongs to root
• Its rights are rwx------ (i.e. only the user it belongs too has rights)