Secure file permissions - Revision history

Arnodb at 07:13, 11 June 2024

2024-06-11T07:13:32Z

← Older revision		Revision as of 09:13, 11 June 2024
Line 1:		Line 1:
	PHP code is run with PHP-FPM as your ULYSSIS user. This means you can tighten up you website's security by denying other users the permission to read your PHP files. However, due to the way the Apache webserver works, it must be able to determine the existence of your PHP files. Non-PHP files in your www directory must remain readable by ~~other users~~, because Apache reads these as its own user.		PHP code is run with PHP-FPM as your ULYSSIS user. This means you can tighten up you website's security by denying other users the permission to read your PHP files. However, due to the way the Apache webserver works, it must be able to determine the existence of your PHP files. Non-PHP files in your www directory must remain readable by others, because Apache reads these as its own user.

	=== Recommended permissions ===		=== Recommended permissions ===

Bert at 00:47, 11 June 2024

2024-06-11T00:47:00Z

← Older revision		Revision as of 02:47, 11 June 2024
Line 13:		Line 13:
	For the permissions mentioned above to fully work, it is important for the parent directories to have the correct permissions. Our system already gives your home directory the correct permissions for this. Other users cannot read your files, or even find out what files exist. Even in case you mistakingly give everyone every permission to one of your files, only you can access it, because others do not have permission to go into your home directory.		For the permissions mentioned above to fully work, it is important for the parent directories to have the correct permissions. Our system already gives your home directory the correct permissions for this. Other users cannot read your files, or even find out what files exist. Even in case you mistakingly give everyone every permission to one of your files, only you can access it, because others do not have permission to go into your home directory.

	{{notice\|Important\| If you have any secret files in your www directory, it may be publicly accessible via your website! Therefore, please make sure any files you want to protect are not in the www directory. }}		{{notice\|Important\|If you have any secret files in your www directory, it may be publicly accessible via your website! Therefore, please make sure any files you want to protect are not in the www directory.}}

Arnodb at 09:12, 9 June 2024

2024-06-09T09:12:16Z

← Older revision		Revision as of 11:12, 9 June 2024
Line 1:		Line 1:
	PHP code is run with PHP-FPM as your ULYSSIS user. This means you can tighten up you website's security by denying other users the permission to read your PHP files. However, due to the way the Apache webserver works, it must be able to determine the existence of your PHP files. Non-PHP files in your www directory must remain readable by other users, because Apache reads these as ~~it's~~ own user.		PHP code is run with PHP-FPM as your ULYSSIS user. This means you can tighten up you website's security by denying other users the permission to read your PHP files. However, due to the way the Apache webserver works, it must be able to determine the existence of your PHP files. Non-PHP files in your www directory must remain readable by other users, because Apache reads these as its own user.

	=== Recommended permissions ===		=== Recommended permissions ===

Arnodb at 09:10, 9 June 2024

2024-06-09T09:10:55Z

@@ Line 7: / Line 7: @@
 * Configuration files containing secrets/passwords: <code>0600/-rw-------</code>
 * Other directories and files that are not part of a website: <code>0600/-rw-------</code> or <code>0700/-rwx------</code>
 === Securing database login info ===
@@ Line 27: / Line 35: @@
 [[Category:Security & anti-spam]]

Arnodb: /* Home directory security */

2024-06-07T21:34:07Z

Home directory security

← Older revision		Revision as of 23:34, 7 June 2024
Line 32:		Line 32:
	For the permissions mentioned above to fully work, it is important for the parent directories to have the correct permissions. Our system already gives your home directory the correct permissions for this. Other users cannot read your files, or even find out what files exist. Even in case you mistakingly give everyone every permission to one of your files, only you can access it, because others do not have permission to go into your home directory.		For the permissions mentioned above to fully work, it is important for the parent directories to have the correct permissions. Our system already gives your home directory the correct permissions for this. Other users cannot read your files, or even find out what files exist. Even in case you mistakingly give everyone every permission to one of your files, only you can access it, because others do not have permission to go into your home directory.

	{{notice\|Important\| If you any secret files ~~into~~ your www directory, it may be publicly accessible via your website! Therefore, please make sure any files you want to protect are not in the www directory. }}		{{notice\|Important\| If you have any secret files in your www directory, it may be publicly accessible via your website! Therefore, please make sure any files you want to protect are not in the www directory. }}

Arnodb: /* Home directory security */

2024-06-07T09:27:30Z

Home directory security

← Older revision		Revision as of 11:27, 7 June 2024
Line 30:		Line 30:
	=== Home directory security ===		=== Home directory security ===

	For the permissions mentioned above to fully work, it is important for the parent directories to have the correct permissions. Our system already gives your home directory the correct permissions for this. Other users cannot read your files, or even find out what files exist. Even in case you mistakingly give everyone every permission to ~~a file~~, only you can access it, because others do not have permission to go into your home directory.		For the permissions mentioned above to fully work, it is important for the parent directories to have the correct permissions. Our system already gives your home directory the correct permissions for this. Other users cannot read your files, or even find out what files exist. Even in case you mistakingly give everyone every permission to one of your files, only you can access it, because others do not have permission to go into your home directory.

	{{notice\|Important\| If you any secret files into your www directory, it may be publicly accessible via your website! Therefore, please make sure any files you want to protect are not in the www directory. }}		{{notice\|Important\| If you any secret files into your www directory, it may be publicly accessible via your website! Therefore, please make sure any files you want to protect are not in the www directory. }}

Arnodb at 09:26, 7 June 2024

2024-06-07T09:26:24Z

@@ Line 7: / Line 7: @@
 * Configuration files containing secrets/passwords: <code>0600/-rw-------</code>
 * Other directories and files that are not part of a website: <code>0600/-rw-------</code> or <code>0700/-rwx------</code>
 === Securing database login info ===
@@ Line 38: / Line 27: @@
 [[Category:Security & anti-spam]]

Arnodb at 22:13, 6 June 2024

2024-06-06T22:13:07Z

← Older revision		Revision as of 00:13, 7 June 2024
Line 3:		Line 3:
	=== Recommended permissions ===		=== Recommended permissions ===

	* www directory (and other directories from where websites are served), including subdirectories: <code>0705/~~drwxr~~-xr-x</code>		* www directory (and other directories from where websites are served), including subdirectories: <code>0705/drwx---r-x</code>
	* Static website files (css, images, html, ...): <code>0604/-rw-r--r--</code>		* Static website files (css, images, html, ...): <code>0604/-rw----r--</code>
	* Configuration files containing secrets/passwords: <code>0600/-rw-------</code>		* Configuration files containing secrets/passwords: <code>0600/-rw-------</code>
	* Other directories and files that are not part of a website: <code>0600/-rw-------</code> or <code>0700/-rwx------</code>		* Other directories and files that are not part of a website: <code>0600/-rw-------</code> or <code>0700/-rwx------</code>

			=== Securing configuration files containing secrets/passwords ===

			If you have any files that you want to protect from the prying eyes of other users, such as API keys, first you need to ensure that the directory containing your important file, is not writeable by other users. This is easiest to do by creating a new directory, dedicated to housing your protected files. For this you can run <code>mkdir safe</code>, followed by <code>chmod 700 safe</code> and finally moving the file into the safe directory. Then you can make your file readable and writeable solely by you. To do this you run <code>chmod 600 safe/name_of_file</code>.

			In Cyberduck, you can do this by making a new directory, right-clicking on it, clicking on "Info", clicking on the "Permissions" tab, and changing the permissions so that for "Owner", all the boxes ("Read", "Write" and "Execute") are ticked and for "Group" and "Other", no boxes should be ticked. Next you can move the protected file into the safe directory. Once you go into the safe directory, you can then finish by right-clicking on the secret file, clicking on "Info", clicking on the "Permissions" tab, and changing the permissions according to the following screenshots:

			[[File:Config-php-dropdown.png]]

			[[File:Config-php-permissions.png]]


	=== Securing database login info ===		=== Securing database login info ===

Erico: updating to use cyberduck

2022-08-15T14:49:26Z

updating to use cyberduck

← Older revision		Revision as of 16:49, 15 August 2022
Line 10:		Line 10:
	=== Securing database login info ===		=== Securing database login info ===

	Suppose you have a file called <code>config.php</code>, containing login information for your database. To secure this information, you can make it readable and writeable by only you, and nobody else using <code>chmod 600 config.php</code>. In ~~FileZilla~~, you can do this by right-clicking on the config file, clicking on "~~File permissions...~~", and changing the permissions according to the following screenshots:		Suppose you have a file called <code>config.php</code>, containing login information for your database. To secure this information, you can make it readable and writeable by only you, and nobody else using <code>chmod 600 config.php</code>. In Cyberduck, you can do this by right-clicking on the config file, clicking on "Info", clicking on the "Permissions" tab, and changing the permissions according to the following screenshots:

	[[File:~~config~~-~~php_dropdown~~.png]]		[[File:Config-php-dropdown.png]]
	[[File:~~config~~-~~php_attrs~~.png]]
			[[File:Config-php-permissions.png]]

	=== Securing uploads directory ===		=== Securing uploads directory ===

	Also, if there are directories that you made writeable by others, e.g. an uploads folder, this is no longer necessary. If this directory is called <code>uploads</code>, you can remove write rights for others with <code>chmod go-w uploads</code>. In ~~FileZilla~~, you can do this by right-clicking on the config file, clicking on "~~File permissions...~~", and changing the permissions according to the following screenshots:		Also, if there are directories that you made writeable by others, e.g. an uploads folder, this is no longer necessary. If this directory is called <code>uploads</code>, you can remove write rights for others with <code>chmod go-w uploads</code>. In Cyberduck, you can do this by right-clicking on the config file, clicking on "Info", clicking on the "Permissions" tab, and changing the permissions according to the following screenshots:


			[[File:Uploads-dropdown.png]]

	[[File:~~uploads_dropdown.png]]~~		[[File:Uploads-permissions.png]]
	~~[[File:uploads_attrs~~.png]]

	[[Category:Files]]		[[Category:Files]]

	[[Category:Security & anti-spam]]		[[Category:Security & anti-spam]]

Vincenttc: /* Recommended permissions */

2020-11-30T23:51:34Z

Recommended permissions

← Older revision		Revision as of 01:51, 1 December 2020
Line 3:		Line 3:
	=== Recommended permissions ===		=== Recommended permissions ===

	* Homedirectory: See [[#Homedirectory permissions \| homedirectory]]		* www directory (and other directories from where websites are served), including subdirectories: <code>0705/drwxr-xr-x</code>
	* www directory (and other directories from where websites are served), including subdirectories: <code>0705/~~drwx--~~-r-x</code>		* Static website files (css, images, html, ...): <code>0604/-rw-r--r--</code>
	* Static website files (css, images, html, ...): <code>0604/-rw----r--</code>
	* Configuration files containing secrets/passwords: <code>0600/-rw-------</code>		* Configuration files containing secrets/passwords: <code>0600/-rw-------</code>
	* Other directories and files that are not part of a website: <code>0600/-rw-------</code> or <code>0700/-rwx------</code>		* Other directories and files that are not part of a website: <code>0600/-rw-------</code> or <code>0700/-rwx------</code>