Best practices in assigning permissions to web folders

Question

I would like to know what is the best, correct and recommended way of doing chown and chmod to website files and folders.

I recently started working on linux and I have been doing it in the site root directory like the following:

sudo chown www-data:www-data -R ./
sudo chmod 775 -R ./

I know it is not the best way. There is a protected folder which should not be accessible with browsers and should not be writable, so I did the following to protected folder:

sudo chown root:root -R protected/
sudo chmod 755 -R protected/

Is it correct? If anything can be improved please let me know.

Answer 1

Read your command again. What you are saying is "make everything executable" below these directories. Does an HTML or gif to be executable? I don't think so.

Regarding a directory which should not be writable by the webserver. Think of what you want to do. You want to revoke the right to write a directory from the webserver and the webserver group (and everybody else anyway). So it would translate to chmod -w theDir. What you did is to tell the system "I want root to make changes to that directory which shall be readable by everybody and the root group". I highly doubt that.

So I would suggest having the directory owned by a webserver user with only minimal read access, it should belong to a group (of users, that is) which is allowed to do the necessary of the modification. The webserver does not belong to that group, as you want the outside world to be prevented from making modifications. Another option would be to hand over all the directories to root and to the editor group and modify what the webserver can do via the "others" permission group. But what to use heavily depends on your environment.

Edit: In general, the "least rights" policy is considered good practice: give away as few rights as possible to get the job done. This means read access to static files and depending on your environment php files, read and execute rights for cgi executables and read and execute rights for directories. Execute rights for directories allow you to enter and read it. No directory in the document root should be writable by the webserver ever. It is a security risk, even though some developers of bigger CMS do not seem to care to much about that. For temporary folders I would set the user and groups to nobody:nogroup and set the sticky bit for both user and groups.