Member Avatar for rom.

Hi there,

A website I'm admin for has a serious security issue. Everytime I make changes to a php script, I chmod -R 777 the var/www directory to make the script work. And if I change this to 775, the photo upload feature on the website doesn't work.

So my questions are:
- What are the real security implications of chmod 777 the entire var/www/
- How do I set the permissions for var/www/ so I can edit/upload scripts without constantly rewriting the permissions
- How can the public upload photos to the server without the directory being 777

(on Ubuntu server 10, apache 2, php 5.3.6)

  • 2 Contributors
  • 1 Reply
  • 266 Views
  • 8 Hours Discussion Span
  • Latest Post Latest Post by nonshatter

Dani AI

Generated

As describes, chmod -R 777 /var/www solves the immediate symptom but opens a big security hole: world‑writable files let any local user or a compromised process drop or modify code. is right to point at ownership changes — the safer pattern is to give the webserver account write only where it needs it, and keep the rest readable but not world‑writable.

A practical baseline (replace youruser with your shell/deploy account):

# make your user owner, Apache group owner
sudo chown -R youruser:www-data /var/www

# directories: setgid so new items inherit group, and allow owner+group rwx
sudo find /var/www -type d -exec chmod 2775 {} \;

# files: readable by all, writable by owner+group
sudo find /var/www -type f -exec chmod 0664 {} \;

# give your login access to the www-data group (logout/login required)
sudo usermod -a -G www-data youruser

With that setup you avoid 777 while both you and Apache can edit files. If new files are created with the wrong mode, either set your umask to 002 or use default ACLs.

Make only the upload/cache dirs writable by the webserver. For example:

sudo chown -R www-data:www-data /var/www/path/to/uploads
sudo chmod 770 /var/www/path/to/uploads
# or use ACLs to grant precise rights:
sudo setfacl -R -m u:youruser:rwx,u:www-data:rwx /var/www/path/to/uploads
sudo setfacl -d -m u:youruser:rwx,u:www-data:rwx /var/www/path/to/uploads

Troubleshooting notes: check Apache/PHP logs (e.g. /var/log/apache2/error.log), confirm PHP's upload_tmp_dir, and remember Ubuntu/Debian Apache usually runs as www-data — but if you use PHP‑FPM, suEXEC, or per‑user pools adjust owners accordingly. Never leave the whole tree 777; limit writable bits to the minimum directories required.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.