Setting secure file permissions

Why Are Secure File Permissions More Important Than Ever?

In the world of web hosting and cloud infrastructure, one of the most common ways attackers breach servers is by exploiting incorrect file permission settings. A file with 777 permissions (where all users have read, write, and execute access) can be a gateway for hackers to run their malicious scripts or steal sensitive information. Setting secure file permissions is not just a preventive measure; it is part of the basic standards of server security.

In this article, you will practically learn how to set the correct permissions for files and directories, avoid common dangers like 777, and use the find command to perform batch corrections as quickly as possible. This guide is useful for server administrators, developers, and anyone working with Linux.

Linux Permissions Basics: Numbers and Their Meanings

Before anything else, you need a precise understanding of the Linux permission system. Each file and directory has three access levels: owner, group, and others. For each level, three types of permissions are defined: read (r=4), write (w=2), and execute (x=1). The sum of these numbers creates the final value.

• 4 = Read — View content
• 2 = Write — Edit and modify
• 1 = Execute — Run the file or enter the directory

For example, the permission 755 means the owner has all access (4+2+1=7), the group can read and execute (4+1=5), and other users also have only read and execute access (5). This value is suitable for most web server files.

Standard and Recommended Values

To set secure file permissions, you need to know what permission each type of file requires:

• Configuration files (such as wp-config.php or .env): 600 or 640 — only the owner (and in the case of 640, the group) can read.
• Script files (PHP, Python, etc.): 644 — the owner can write, others can only read.
• Directories: 755 — the owner has full access, others can enter and view files.
• Upload files (such as the uploads folder): 755 for directories and 644 for files.

Important note: If you are using PHP-FPM with a separate user, you may need to set the ownership. In this case, the file owner should be the PHP-FPM user, and 600 permissions are sufficient for sensitive files.

Dangers of Using 777 Permissions and Secure Alternatives

The 777 permission means any user on the system (even unauthorized users) can read, write, and execute the file. This situation is a security disaster in shared or public server environments. Hackers can:

• Replace original files with malicious ones.
• Place backdoor scripts in upload folders.
• Read sensitive information such as passwords or API keys.

If your files have been changed to 777 due to upload issues or script installations, you must fix them immediately. But instead of using 777, there are more secure solutions:

1. Change file ownership: Use the chown command to change the file owner to the web server user (e.g., www-data).
2. Use 755 for directories: This value allows the web server to read and execute files, but only the owner can write.
3. Use 644 for files: If the web server only needs to read, this value is sufficient.

For example, if your uploads folder has been mistakenly set to 777, you can fix it as follows:

chmod 755 /var/www/html/uploads
find /var/www/html/uploads -type f -exec chmod 644 {} \;

This command first changes the directory permission to 755 and then sets all files inside it to 644.

Common Mistake: Forgetting Hidden Files

One of the common mistakes in setting secure file permissions is ignoring hidden files (such as .htaccess or .env). These files often contain sensitive information and should have 600 permissions. Use the following command to check them:

ls -la /var/www/html/

The output of this command shows all files, including hidden ones, along with their permissions. If you see hidden files with open permissions (like 644 or 777), fix them:

chmod 600 /var/www/html/.env

Batch Permission Correction with the find Command

On real servers, you typically encounter hundreds or thousands of files whose permissions need to be corrected in bulk. The find command is the best tool for this task. It allows you to filter files based on type, size, modification time, and other criteria, and then perform the desired operation on them.

Correcting Directory and File Permissions Separately

One of the best methods for setting secure file permissions is applying different permissions to directories and files. Directories should be 755 and files should be 644. With the following two commands, you can do this across the entire project structure:

find /var/www/html -type d -exec chmod 755 {} \;
find /var/www/html -type f -exec chmod 644 {} \;

The first command finds all directories and changes their permissions to 755. The second command does the same for files with 644 permissions. This method is highly efficient and secures your entire project structure in just a few seconds.

Using find to Locate Dangerous Files

In addition to correcting permissions, you can use find to identify files with dangerous permissions. The following command finds all files with 777 permissions:

find /var/www/html -type f -perm 777

If the output of this command is empty, there are no dangerous files. Otherwise, you can fix them with the following command:

find /var/www/html -type f -perm 777 -exec chmod 644 {} \;

This command finds all files with 777 permissions and changes them to 644. Similarly, you can find and fix dangerous directories:

find /var/www/html -type d -perm 777 -exec chmod 755 {} \;

Filtering by File Extension

Sometimes you only need to change the permissions of specific files. For example, if you want to change only PHP files to 644:

find /var/www/html -type f -name "*.php" -exec chmod 644 {} \;

Or if you want to change executable files (such as shell scripts) to 755:

find /var/www/html -type f -name "*.sh" -exec chmod 755 {} \;

This method gives you more precise control over files that need execute permissions.

Advanced Tips: Ownership and Groups

Setting secure file permissions is not limited to permissions alone; ownership also plays a critical role. If the file owner is incorrect, even with correct permissions, security issues may arise. For example, if web server files belong to the root user, the web server cannot read them (unless the permission is 644).

To change the ownership of files and directories to the web server user (usually www-data on Ubuntu or nginx on CentOS), use the following command:

chown -R www-data:www-data /var/www/html

However, note that this may not be suitable for sensitive files like .env. In such cases, it is better to give ownership to your primary user and only provide read access to the web server.

Common Mistake: Using chmod -R Without Filtering

One of the biggest mistakes novice administrators make is using the chmod -R 777 command for an entire directory. This not only completely destroys security but may also damage system files. Always use find with appropriate filters so that only the intended files are changed.

For example, instead of the following dangerous command:

chmod -R 777 /var/www/html

Use the following secure commands:

find /var/www/html -type d -exec chmod 755 {} \;
find /var/www/html -type f -exec chmod 644 {} \;

This method ensures secure file permissions while not disrupting web server functionality.

Summary and Best Practices

Setting secure file permissions is one of the most important measures to protect your server. By following the tips below, you can prevent many common attacks:

• Never use 777 permissions; always choose secure alternatives like 755 and 644.
• Protect sensitive files like .env and wp-config.php with 600 permissions.
• Use the find command for batch permission corrections and always manage files and directories separately.
• Set file ownership correctly and avoid unnecessary changes to system file ownership.
• Periodically search for and fix files with dangerous permissions using the find command.

If you are looking for a comprehensive solution for web hosting and server management, ServerNet's web hosting services and cloud infrastructure can be a suitable option. However, regardless of which service you use, following the security principles discussed in this article is your primary responsibility as a system administrator.

By implementing these guidelines, you can ensure that your files are protected against unauthorized access and that your server is resilient against common attacks. Remember that security is an ongoing process, not a one-time action. Therefore, regularly review and update your file permissions.