Can uploaded files override Apache permissions?

Question

I teach web development courses to liberal arts majors, and the web server (Ubuntu Apache) is located in my office. At the beginning of each semester, I create public_html directories for each of my students and recursively set the permissions so their files will be served up correctly.

Every once in a while, a student reports permissions problems with a file she has uploaded. It is easy enough to fix this by tweaking permissions in Filezilla, but I have always wondered about the apparently inconsistent nature of this problem.

Possible explanation 1. I screwed up when creating the account and did not actually remember to recursively set the permissions.

Possible explanation 2. The uploaded file already had certain permissions attached to it that override the permissions I had set on the server.

Based on everything I think I understand about web servers, the first option seems far more likely. Is possible explanation 2 even theoretically possible?

Thanks!

Answer 1

"Option 1."

Write a script. Something like

create_account <student name>

will do well. In the script do your create the directory(ies) and then make sure permissions are right. More or less, something like that:

mkdir -p ~$1/public_html/{js,css,images}
chown -R $1:www-data ~$1/public_html

You could also create the student account at the same time. (user_add)

Note that my sample assumes that the <student name> is one word (no space or special characters) which is usually what you get with Unix users.

"Option 2."

You mention Filezilla, which is an FTP tool.

Most FTP tools have the CHOWN and CHMOD instructions that they can use to change the ownership and permissions.

The CHOWN fails if user does not have high permissions on the destination server.

The CHMOD instruction may succeed and remove, for example, write permissions.

Either way, the user/owner of the file can change the permissions with another CHMOD. I do not know whether Filezilla supports such, but it could be. I also do not know whether it would apply the CHMOD automatically, especially if the file comes from a MS-Windows system.

To better answer this "option" (it's a "Case" really), you would have to find out whether you can reproduce the problem after you ran your perfect script. First, fix the script and then try again.

Side Notes

FTP is not considered safe, SSH is much safer. There is SFTP which works over SSH and you should at least be using that. You do not specify so I cannot say whether you're using the wrong protocol or not.