What should my folder permissions be set at?

[natecoupons]

I have noticed that some of my server folders permissions are set to 755, others are set to 747.

What is the danger in this, and are their exceptions? Should any folder ever be set to 777?

[Angel-Wings]

Generally it isn't a good idea to let the same user that runs PHP scripts write anywhere in the webroot so 755 / 777 isn't a good (and safe) idea.
If you still want to store attachments in the filesystem put this directory outside the webroot, chown it the user running PHP and set it to 700.
Maybe a simple example:

/home/www/site/webroot - that's the folder your Webserver is serving

If you run PHP as user "example" and Apache is running under "www" - both group and user - the "webroot" can be set to 550 if example owns it and www is the group.

/home/www/site/uploads - folder where attachments belong - this directory isn't served by your Webserver

Set to 700 if "example" owns this directory.

If you still need to let PHP put files inside the webroot so you've folder left where PHP can write files, you can prevent PHP from parsing scripts there - as example:


<Directory "/home/www/site/webroot/signaturepics">
php_flag Engine Off
</Directory>


Or when running FastCGI removing the Handler.

That's all just in case character filtering isn't done correctly so someone could put an executeable PHP script in your webroot to - well - from dumping your DB to abuse your machine for attacking other sites.

Just a note: changing permission for directories to 550 and to 440 for files may also prevent FTP from storing or changing files so these permissions would need to set back before chaning files through FTP.

[natecoupons]

okay does vbulletin have standards of security for folders?

I'd just like a simple list that says:
admincp - 755
archive - 645
clientscript - 747

etc.

I don't want to change any of the permissions because I just know that it will affect something. I also don't want to leave the server open to attack or hacking.

[Angel-Wings]

Well - not using archive so unsure about it's permissions but every VB folder is set to 555 here except:

clientscript/vbulletin_css

That's set to 755. In this folder all files are set to 644, the rest of all VB files to 444

It may differ if you let users upload signature images and these are stored in the filesystem - then this folder requires write permission too.

And - some modifications may require write access somewhere :)

[natecoupons]

Hmmmm well this evening ill start changing my permissions. I need to really secure our server after an incident.