File Permissions for Webpages - Revision history

Steve410: /* CGI and PHP Programs */

2025-10-08T14:25:25Z

CGI and PHP Programs

Pip: /* File Permissions and our Webserver */

2024-12-18T19:52:48Z

File Permissions and our Webserver

Steve410: /* Summary */

2022-02-02T16:29:12Z

Summary

Phil: /* File Permissions and our Webserver */

2022-02-02T16:22:17Z

File Permissions and our Webserver

Phil: /* File Permissions and our Webserver */

2022-02-02T16:17:55Z

File Permissions and our Webserver

Phil: /* Summary */

2022-02-02T16:14:49Z

Summary

Phil: /* Summary */

2020-05-14T15:08:11Z

Summary

Phil: /* Summary */

2020-05-14T15:07:29Z

Summary

Phil: /* File Permissions and our Webserver */

2020-04-13T15:34:28Z

File Permissions and our Webserver

Phil: /* Summary */

2020-04-13T15:33:34Z

Summary

@@ Line 56: / Line 56: @@
 == CGI and PHP Programs ==
-All CGI and PHP programs run under your account, ''not'' the <code>apache</code> account of the webserver.  In order for that to work properly, the CGI script must not be modifiable by anyone other than you.  In other words, neither it, nor any of its parent directories (e.g. <code>~/public_html/cgi-bin</code>, <code>~/public_html</code>, your home directory, etc.) can have group or other write permissions.
+All CGI and PHP programs run under your account, ''not'' the <code>apache</code> account of the webserver.  In order for that to work properly, the CGI script must not be modifiable by anyone other than you.  In other words, neither it, nor any of its parent directories (e.g. <code>~/public_html/cgi-bin</code>, <code>~/public_html</code>, your home directory, etc.) can have ''group'' or ''other'' write permissions.
 PHP programs are all run via the script at <code>~/public_html/cgi-bin/php-cgi</code>, so that's the only file that absolutely needs to have its write access restricted for PHP to work.

@@ Line 34: / Line 34: @@
 Every personal account on our systems is a member of the <tt>users</tt> group.  Our webserver runs as an account (<tt>apache</tt>) that is ''not'' a member of the <tt>users</tt> group.  Because of the way Unix permissions are resolved, this means that you can make the group permissions of files owned by the <tt>users</tt> group ''more'' restrictive than the global permissions.  That will have the net effect of allowing access to the webserver's account while denying access to other people using our shared systems.
-Thus, HTML files any any other files the webserver needs to access should have the following permissions:
+Thus, HTML files and any other files the webserver needs to access should have the following permissions:
 * user: read and write

@@ Line 9: / Line 9: @@
 * Your home directory, your <code>public_html</code> directory, your <code>public_html/cgi-bin</code> directory, and your <code>public_html/cgi-bin/php-cgi</code> script '''must not''' have group or global ''write'' permissions
 * If you're [[Displaying Directory Contents In A CS Webpage|displaying directory contents without an index.html file]], any affected directory will also need global ''read'' permissions.
-* Any files outside your <code>public_html</code> directory that the web server needs to access (e.g. password files for HTTP authentication) '''must have''' global ''read'' permissions
+* Any files outside your <code>public_html</code> directory that the web server needs to access (e.g. ''password files for HTTP authentication'') '''must have''' global ''read'' permissions
 * Any directories containing files that the web server needs to access '''must have''' global ''execute'' permissions

← Older revision		Revision as of 16:22, 2 February 2022
Line 51:		Line 51:

	umask 072		umask 072
		+
		+	'''NOTE''': In some cases, the webserver may need to access files outside your <code>~/public_html</code> directory. This generally only occurs if you've added directives to <code>.htaccess</code> files and those directives point at files elsewhere in your directory tree. In those cases, the webserver will need read access to those files, too. This does ''not'' apply to files accessed only by CGI or PHP programs; see the next section for those.

	== CGI and PHP Programs ==		== CGI and PHP Programs ==

@@ Line 34: / Line 34: @@
 Every personal account on our systems is a member of the <tt>users</tt> group.  Our webserver runs as an account (<tt>apache</tt>) that is ''not'' a member of the <tt>users</tt> group.  Because of the way Unix permissions are resolved, this means that you can make the group permissions of files owned by the <tt>users</tt> group ''more'' restrictive than the global permissions.  That will have the net effect of allowing access to the webserver's account while denying access to other people using our shared systems.
-Thus, HTML files for the webserver should have the following permissions:
+Thus, HTML files any any other files the webserver needs to access should have the following permissions:
 * user: read and write

@@ Line 7: / Line 7: @@
 * '''All files''' in your <code>public_html</code> directory (and all of its subdirectories, etc.) '''must have''' global ''read'' permissions
 * Your home directory, your <code>public_html</code> directory, and all directories within your <code>public_html</code> directory '''must have''' global ''execute'' permissions
 * Your home directory, your <code>public_html</code> directory, your <code>public_html/cgi-bin</code> directory, and your <code>public_html/cgi-bin/php-cgi</code> script '''must not''' have group or global ''write'' permissions
 * If you're [[Displaying Directory Contents In A CS Webpage|displaying directory contents without an index.html file]], any affected directory will also need global ''read'' permissions.

@@ Line 30: / Line 30: @@
 * The webserver needs to be able to read the files (so it can serve them to the world), but it probably doesn't need to write to them.
-Every personal account on our systems is a member of the <tt>users</tt> group.  Our webserver runs as an account (<tt>apache</tt>) that is ''not'' a member of the <tt>users</tt> group.  Because of the way Unix permissions are resolved, this means that you can make the group permissions of files owned by the <tt>users</tt> group ''more'' restrictive than the global permissions, and that will have the net effect of allowing access to the webserver's account while denying access to other people using our shared systems.
+Every personal account on our systems is a member of the <tt>users</tt> group.  Our webserver runs as an account (<tt>apache</tt>) that is ''not'' a member of the <tt>users</tt> group.  Because of the way Unix permissions are resolved, this means that you can make the group permissions of files owned by the <tt>users</tt> group ''more'' restrictive than the global permissions.  That will have the net effect of allowing access to the webserver's account while denying access to other people using our shared systems.
 Thus, HTML files for the webserver should have the following permissions:

@@ Line 5: / Line 5: @@
 The short version of this page is this:
-::'''All files''' in your <code>public_html</code> directory (and all of its subdirectories, etc.) '''must have''' global ''read'' permissions; your home directory, your <code>public_html</code> directory, and all directories within your <code>public_html</code> directory '''must have''' global ''execute'' permissions; and your home directory, your <code>public_html</code> directory, your <code>public_html/cgi-bin</code> directory, and your <code>public_html/cgi-bin/php-cgi</code> script '''must not''' have group or global ''write'' permissions.
+* '''All files''' in your <code>public_html</code> directory (and all of its subdirectories, etc.) '''must have''' global ''read'' permissions
+* Your home directory, your <code>public_html</code> directory, and all directories within your <code>public_html</code> directory '''must have''' global ''execute'' permissions
-::(If you're [[Displaying Directory Contents In A CS Webpage|displaying directory contents without an index.html file]], any affected directory will also need global ''read'' permissions.)
+* Your home directory, your <code>public_html</code> directory, your <code>public_html/cgi-bin</code> directory, and your <code>public_html/cgi-bin/php-cgi</code> script '''must not''' have group or global ''write'' permissions
 If you just want to set all of the permissions to our recommended default values, log in to one of our [[:Category:Linux Clients|Linux clients]] and run the following commands: