file/folder permissions [resolved]

[MixMaster]

Hi,
I have written a PHP that saves its data into files contained in a subfolder of the directory of the script. I cant figure out what CHMOD permissions I need to give to the scripts to make this work how I want.

Basically the script needs to be able to read and write to the files in the folder, occasionally it will also create new files and it will occasionally delete files that are no longer required.

What file permissions do I need to set on the folder so that an internet user can not just type in the URL of this folder and read the files? Also if they know the full path and filename of the files they should not be able to read them either.

Will I need to get my PHP script to set file permissions on the new files that it creates? if so, how?

I would very much appreciate any help on this matter. (call me a unix n00b if you must)

Regards,

Tim

[Electroman]

I think this might be more a matter for a .htaccess file if you want to disallow people viewing anything in the folder .

[visualAd]

The UNIX file permissions are quite easy to understand. The permissions for each file and directory are reperesented using a four digit octal number.

The first digit represents the superuser,
the second is the owner of the file,
the third is the group owner of the file
and the fouth is everyone else.

On a secure UNIX system web server files should not be owned by the same user and group as the user and group the web server itself runs. Therefore to allow or dissalow access to directories and files hosted by your web server you set the permissions on the fouth octal.

Heres some more info about UNIX file permissions:
http://www.macosxhints.com/article.p...01231152532966

You can also like Electroman said deny access through the .htaccess files - if your web hosts allows you to use them.

[MixMaster]

Ok thanks, my web host only seems to allow me to do CHMOD with a three digit octal number. It does allow .htaccess but I dont know what to put in the file, I put a .htaccess file in the directory and it contains "username:scrambled_up_password" but whenever I visit the folder I get "500: Internal server error." I suppose this is working as it's not letting anyone see the files but i was expecting "403: Forbidden" or something similar. Is this correct?

[visualAd]

To return a 403, you only need one line in the .htaccess file:

Deny From all

If you want username and password authentication. Look here:
http://httpd.apache.org/docs-2.0/howto/auth.html

[MixMaster]

Thankyou, I'll give it a try.