Timeline for When creating a website, what permissions and directory structure?
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 16, 2011 at 8:55 | comment | added | Lekensteyn |
Giving www-data rwx on directories allows www-data to read, write and descend into directories. If www-data is the owner, it'll be able to change the file permissions as well. If www-data does not need write access, you'd better revoke it to r-x (principle of least privilege). Processes run under an user which are a member of one ore more groups. If a file is not owned by the user of that process or if the process user is not a member of the group of the file, it'll get the permissions of "Other" (a.k.a. "world").
|
|
| May 16, 2011 at 3:18 | comment | added | Dan Simmons | Thanks so much for the pointers. I'm just curious, is there any security risk in giving www-data 'rwx'? Also, what processes access files/directories as 'other'? | |
| May 12, 2011 at 18:56 | comment | added | Lekensteyn |
@Dan Simmons: CMS'es (and PHP scripts) write to the directories as www-data, the files will be owned by www-data with group www-data (since the process runs under that group). Your SSH user will create files/directories owned by your_ssh_user_here. Without the setgid bit, these files will have the group your_ssh_user_here. With no read permissions for the other, PHP and nginx won't be able to access the files/directories. The setgid bit is inherited by the directories beneath (but can be removed).
|
|
| May 12, 2011 at 18:41 | comment | added | Dan Simmons | Two questions for clarification: 1) What's the purpose of joining www-data with your ssh_user? 2) After reading about the setgid bit, what's the purpose of toggling it for directories/subdirs? Put another way, in what situations will this behavior differ from normal? | |
| May 12, 2011 at 16:56 | comment | added | Dan Simmons | Thanks so much! I appreciate the completeness of your answer! It hit all of the major points I was looking for. | |
| May 12, 2011 at 16:53 | vote | accept | Dan Simmons | ||
| May 12, 2011 at 8:45 | history | answered | Lekensteyn | CC BY-SA 3.0 |