Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I would like to protect a public directory from public view. None of the files will ever be viewed online. I chmoded the directory to 700 and created an htaccess file that has "deny from all" inside it. Is this enough security or can a hacker still gain access to the files? I know some people will say that hackers can get into anything, but I just want to make sure that there isn't anything else I can do to make it harder to hack.

Reply:

I am asking if chmod 700 and deny from all is enough security alone to prevent hackers from getting my files. Thanks.

share|improve this question
add comment

migrated from stackoverflow.com Sep 16 '11 at 9:43

This question came from our site for professional and enthusiast programmers.

2 Answers

up vote 3 down vote accepted

I would like to protect a public directory from public view. None of the files will ever be viewed online.

With public directory I assume you mean a directory that you have made available online via your HTTP server.

You can normally configure that within your HTTP server. You should deny access to it. Assuming you can trust your webserver, this should do the job.

Chmod'ding to 700 will allow access to the file owner. If the webserver is running under the file-owner (or a subprocess initialized by your webserver), file access would be allowed. This might be intended, e.g. your PHP script runs under that user and your PHP process should access the file.

So configure your webserver to deny access to that directory in question and you should be fine.

To improve the situation, you should move the whole directory out of the public webroot, e.g. to a private directory. That done, your webserver does not need to revert part of it's configuration for a specific directory. Private directories are normally already appropriately chmod'ed. This will give you a bit more control about the situation.

A cracker however will gain access to your system by exploiting your system via some of its components and the bugs in there, normally with the goal to obtain root privileges. That done, the attacker has access to everything regardless of your configuration. So what you suggest to do will not specifically protect your system from crackers but just be a conceptual correct configuration.

To protect against crackers you need a system-vendor and sysadmins that take care of your system, e.g. by hardening the software and it's configuration. We share the code, we share the bugs.

share|improve this answer
add comment

in php you can specify folders on your server that php will also look in. These folders can be (and usually are) not in the same directory the web files are. Only php can access these files, so therefor are not browse-able on the web (if they are not in the websites dir)

Should be include_path in the php.ini file

share|improve this answer
    
Example: I have my database settings file in a /db folder on the root drive, this folder in mentioned in the include_path of my php.ini file, I can include my db settings file by include('/db/db.php'); but /db is still not a directory in my website, only php can see and access it. –  thegaffney Sep 16 '11 at 5:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.