Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've recently setup a new virtual server to host my websites. I'm pretty new to Linux based systems and sysadmin stuff and as a result have a few questions with regards to file and directory permissions.

My main site is located in /var/www and in there I have a directory where I keep a few PHP scripts, one of which contains the connection details to the database. What I'm looking to do is ensure that nobody has access to these scripts by visiting www.mydomain.co.uk/mydir but are still accessible to the www-data user so they can actually be called and executed from other pages on the site.

My initial thought is to change the permissions on the files to 400; however, I don't know what to do with regards to the permissions of the directory.

How do I change the permissions on the directory so that the files within it can be executed but not seen by people when they visit www.mydomain.co.uk/mydir?

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

You can fix this via apache configuration. See http://httpd.apache.org/docs/2.2/howto/access.html

Using a

<Directory /mydir>
    Order deny,allow
    Deny from all
</Directory>

, outside access to the directory is blocked, but php-scripts are still allowed to access it.

share|improve this answer
    
Thank you etagenkio. That's exactly what I was looking for. –  Martyn Apr 3 '13 at 21:14
add comment

A correctly configured Apache/PHP stack will not allow the .php file containing your database details to be output to the browser, because it will be interpreting it as a .php script and not text. So if someone stumbles on that directory or file, they will not see the database login -- again, provided Apache is configured correctly and there are no errors in your script.

However, it is good practice to place scripts in a different directory from the public-facing directory, one that is not served directly by Apache. Many helpful answers are available on Stackoverflow with some searching, here's one:

http://stackoverflow.com/questions/2573496/help-securing-files-access-with-htaccess-and-php

Edit:

And another.

http://stackoverflow.com/questions/6524565/php-file-security-on-webserver

Also if you're really serious about learning PHP I'd check out some frameworks to learn WHILE you're learning the language, which help handle some of this stuff for you and also provide security in areas you didn't know you needed it. PHP isn't an inherently insecure language but it is very easy to write an insecure application.

http://www.yiiframework.com/

http://ellislab.com/codeigniter

share|improve this answer
    
Thanks for your advice and the links. –  Martyn Apr 3 '13 at 21:33
add comment

if you have a index.php it wont matter if they do go to /var/www/mydir because it will only display what is in the index.php..

share|improve this answer
    
They can not list the directory, but they could still guess random names and try t get the file. This would not do what the OQ intended. –  Rich Homolka Apr 3 '13 at 22:14
    
true, i guess ive never worried about it! –  dashboard Apr 3 '13 at 23:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.