Question

I just ported my website server which allow file uploading . Now it runs vps on ubuntu 11.04.
Uploaded files are stored in folder call files which had owner : root and group :root as similar to other folders.

But problem is when i tried to run the php function (readfile()) to read any of the file from the folder it didn’t read that file and But when i changed the folder owner and group to 10000 and 1005 which is same as was in previous server. PHP instantly found that file and downloading was started. I was not able to guess what is problem and how this happened. Because i have tried changing files and its content group and owner to root.

Can anyone describe how this happened, and how to change it to again my own group or owner.And also there is no group and owner named 10000 and 1005 presently in my VPS.

Is it some kind of, bug or hacking done on server.

Answer 1

on ubuntu apache’s user is www-data.

In your first scenario apache did not have the correct access. Take for example default permissions on 12.04 for /var/www directory

-rw-r--r-- 1 root root 177 Sep 15 11:43 index.html

As you can see apache can only r this file. And that is all it needs to do.
The first set -rw- corresponds to the user. The second set of perms r-- correspond to the group and the third set r-- correspond to everyone else.

Since php is being run by www-data you would not be able to to write to this file.

Creating a upload directory in /var/www using sudo mkdir uploads gives permissions.

drwxr-xr-x 2 root root 4096 Nov 8 11:59 uploads

once again www-data is not able to write to the uploads directory!

You could open up the ‘other’ permissions (not good because any user could then write to this directory, when in fact you only want www-data to be able to write), you could add www-data as the owner of this directory. You could create an admin group or something and add www-data to it, (or just change group to www-data if no other users need to use it, and probably many other more secure ways, i’m not a sys admin, that is why serverfault would be good:))

As for your user issue, it is def a problem if a user doesn’t exist and you try to use chown

daniel@daniel:/var/www$ sudo chown doesnotexist:stuff uploads/
chown: invalid user: doesnotexist:stuff'

Did you check which users are presnet? using groups or cat /etc/passwd?