This is an update to an <a href="http://community.plus.net/forum/index.php/topic,80496.msg655494.html#msg655494">earlier post</a>.
Paranoid permissions are not quite as essential on the new ccgi server, but why give the hackers an inch?
Contrary to any remaining sources that recommend php files should have permissions set to 755 (0755: -rwx,r-x,r-x), this is not necessary on the ccgi platform. Setting group and other permissions on script files is potentially insecure.
The default permissions for php files should rather be 700 (0700: -rwx,---,---).
Bulk modifying all files and folders to 755 or 750 will allow sites to work, but this is potentially insecure and not best policy.
Permissions should be set selectively:
Folders 710 (0710: drwx,--x,---) is still recommended, or 750 if necessary. Some packages, like Wordpress, may encourage you to set some folder permissions to 777, but that would be imprudent. If 710 is insufficient, try 750 but no higher.
Scripts 700 (0700: -rwx,---,---) and no higher.
Static web content (html, css, js, etc.) and Apache files (htaccess, htpasswd) can be left at the default 640 (0640: -rw-,r--,---).
Files which are only read from and written to by scripts, but not served to browsers, such as log files, ini files and certificate files can be set to 600 (0600: -rw-,---,---).
Permissions can be set selectively using most FTP clients (control click in the file lists to select multiple files of the same type (or apple click on Macs)). For large numbers of files in deep folder trees, it may be easier to use a script, such as the one given below.
If nothing else, php files which contain login details, such as MySQL passwords, should be set to 700.
#!/bin/bash
echo "Content-type: text/html"
echo
find . -type d ! -perm 1710 -print0 | xargs -0 chmod 710
find . -type f -regextype posix-extended -regex '.*\.(php|pl|cgi)$' -print0 | xargs -0 chmod 700
echo "<table border='1'><tr><th>Type</th><th>Name</th><th>User, Group</th><th>Permissions</th></tr>"
find . -type d -printf '<tr><td>Folder</td><td>%p</td><td>%u, %g</td><td>%M</td></tr>'
find . -type f -printf '<tr><td>File</td><td>%p</td><td>%u, %g</td><td>%M</td></tr>'
echo "</table>"
(Give it a .cgi extension, load it to your web root, set its own permissions to 700 and call it with a web browser. You can change "chmod 710" to "chmod 750", but don't edit "! -perm 1710", which tells the script not to chmod your root folder.)
Gabe
