(jeffa) 2Re: Creating and writing a file to a password protected directory

Good deal. I recommend that you remove the 777 permissions from that directory and instead chown the directory to what ever user the web server runs as. I assume you are using Apache, correct? Use grep or egrep for 'User' on httpd.conf:

egrep ^User /path/to/conf/httpd.conf

to find out which user. Then you can chmod the directory to a safer 755.

jeffa

L-LL-L--L-LL-L--L-LL-L--
-R--R-RR-R--R-RR-R--R-RR
B--B--B--B--B--B--B--B--
H---H---H---H---H---H---
(the triplet paradiddle with high-hat)

Comment on (jeffa) 2Re: Creating and writing a file to a password protected directory

Replies are listed 'Best First'.
Re^3: Re: Creating and writing a file to a password protected directory by diotalevi (Canon) on Oct 12, 2002 at 21:24 UTC
Depending on the data 755 may also be unsafe. I'm guessing that whatever data is being written must be both private and correct. If you were I then I'd set the minimum possible permissions and ensure that the process doing the writing was either the directory and file owner or at least in the right group. I'd hate for you to write down credit cards or something using that scheme. In general consider this advice incomplete and a guess at best. If you don't already understand unix permissions then you'll have to learn them prior to completing whatever you're doing. Of course there's additional security to be had by using public-key cryptography. Again, you have to know what you're doing to use it sanely (like not putting the private key on the server among others). `__SIG__ printf "You are here %08x\n", unpack "L!", unpack "P4", pack "L!", B:: +svref_2object(sub{})->OUTSIDE` [download]	[reply] [d/l]

Replies are listed 'Best First'.

Re^3: Re: Creating and writing a file to a password protected directory
by diotalevi (Canon) on Oct 12, 2002 at 21:24 UTC

Depending on the data 755 may also be unsafe. I'm guessing that whatever data is being written must be both private and correct. If you were I then I'd set the minimum possible permissions and ensure that the process doing the writing was either the directory and file owner or at least in the right group. I'd hate for you to write down credit cards or something using that scheme. In general consider this advice incomplete and a guess at best. If you don't already understand unix permissions then you'll have to learn them prior to completing whatever you're doing. Of course there's additional security to be had by using public-key cryptography. Again, you have to know what you're doing to use it sanely (like not putting the private key on the server among others).

__SIG__
printf "You are here %08x\n", unpack "L!", unpack "P4", pack "L!", B::
+svref_2object(sub{})->OUTSIDE
[download]

[reply]
[d/l]