Write permissions on uploaded files - Linux, Apache, PHP

Question

I am working on a PHP script that transfers files using FTP functions. It has always worked on my production server (which is a hosting service). The development server I have just setup (I am a novice to servers) is Debian Lenny with Apache2, PHP5, and MySQL5.

The file transfer works correctly, but once the file has been written to the server, it has permissions of 600. This makes it impossible for me to view the file (JPEG) in the web browser, as permission is denied. I have scoured the internet and even broken my server installation and reinstalled it trying to figure this out (which has been fun, nonetheless!).

I know it is unwise to set 777 permissions on public accessible files, but even that will not solve the problem. The only thing that works is if I chmod 777 thefile.jpg after it has been transferred, which is not a working solution.

I tried changing the owner of my site files to www-data per this post, but that also does not work.

My user is mike, and it still does not work whether the owner of the files is mike or root.

Would somebody point me in the right direction? Thanks! And, of course, let me know if I can clarify anything.

Solution 1

this is more related to your ftp server configuration, and not so much to apache. which server are you using for ftp? i believe vsftpd is the default ftp server for Debian Lenny, the options you might need to look at in your vsftpd.conf file are: chown_upload_mode and file_open_mode

the default for chown_upload_mode is 0600 which makes me think that might be what you need to set, and then restart your FTPd and try again.

Solution 2

It sounds like Apache is not configured to serve files out of the directory that the file is being saved to. You need to ensure there is a Directory directive in you Apache configuration that permits access to the directory that the file is in. For example:

<Directory "/home/mike/uploads">
  Order allow,deny
  Allow from all
</Directory>

Also the www-data user needs to have permission to traverse the directory tree leading to the directory. E.g. if the file is at /home/mike/uploads then the home, mike and uploads must have execute permisson allowed for other users.

Comments

[Mike Moore]

Ahhh that makes sense! Yes, I installed vsftpd so that I could transfer files from my workstation to the server. I'm looking at it now...

[DevGambit]

it might work, but it is highly inadvisable. running a system service as a trusted user mike is not a very good idea, and changing ownership, recursively no less, of a system directory to mike is also not a great idea. you could look into implementing suphp or a similar product suphp.org/Home.html, suphp allows php scripts to run as a user, in this case mike allowing you to do what you want. sudo chmod -R 2750 /var/www makes me wish i was there to stop you... for what you want, files should be 644

[DevGambit]

and i'm not saying sudo chmod -R 2644 /var/www would have been a solution either, a recursive chmod like that is just... disaster waiting to happen.

[Mike Moore]

Do you think it would be a good idea to try and use the same FTP application that my hosting service uses?

[DevGambit]

you will want to set chown_upload_mode and file_open_mode to 644 which allows read/write to the owner, read to group, and read to world. permissions work like this: 1 = execute, 2 = write, 4 = read. 7 = read/write/execute, and so on.

[DevGambit]

i don't know, but whatever you use to send files to your web server, you'll need to look at the umask and permissions options in the configuration. also, most FTP clients will allow you to set permissions on files you have uploaded, so check the settings of your ftp client as well.

[Mike Moore]

@cpbills I'm cleaning up some of the stuff I did. Any comments about how I changed User ${APACHE_RUN_USER} and Group ${APACHE_RUN_GROUP} ?

[DevGambit]

you would change that in your apache configuration, and i would keep it as www-data and www-data

[Mike Moore]

I ended up having internet connection difficulties with Debian and finally reinstalled Ubuntu 10.04 Server Edition. The internet problem was resolved. I started everything over and ended up only uncommenting write_enable=YES and local_umask=022 in /etc/vsftpd.conf. This allows my PHP FTP script to transfer files with permissions of 0644. This allows my other scripts to actually be able to read the images for displaying them in the browser. Thank-you for pointing me towards vsftpd.conf, as that was the solution.

[Mike Moore]

this did not work for my problem, but thanks for your help. I am still so new to this that this could very well be another solution for my problem and I don't even know it! If anything, it helped me dive a little deeper into Apache.