Set php file permissions so only my server's curl can run

Question

I have a PHP script that I don't want anyone to be able to run through their browser.

It sends emails and is called via curl by my server's cron, yet needs to be in the public www directory. What permissions or owner do I need to set the file to to allow only my server's curl to execute (or do I mean read) the file?

I'm on centos.

Thanks!

Answer 1

Why not just use php-cli to run it from the command line instead of through curl?

If you really have to host it you can do something like this in your .htaccess

<Directory /your/path/>
Order allow,deny
Allow from 192.168.1.0/24
Allow from 127
</Directory>

Answer 2

If you can, I would recommend doing it a different way: Running the script through the CLI (calling php -f in the cron job) and having the PHP script check how it is run. You can find out whether the script is called from the Command Line Interface using php_sapi_name(), and terminate when it's being called from the web. That would be the most secure solution as far as I can see.

If you really need to get it through curl, use Josh's solution or define a passkey that needs to be added to the script as a get parameter:

curl domain.com/script.php?password=123456

not terribly secure as the passkey will be visible in the crontab, but should provide decent protection against access from the outside, especially if you combine it with checking $_SERVER["REMOTE_ADDR"] and making sure it is 127.0.0.1.

Answer 3

You could either limit access to the files by placing a .htaccess file with appropriate access limitations in the directory or by implementing a basic password check at the beginning of your php file like this:

<?php
$password = $_GET['password'];
hash = '40bd001563085fc35165329ea1ff5c5ecbdbbeef'; //precalculated sha1 hash of your password
if (sha1($password) != $hash) {
    die('Forget it!');
}

For added security this could be further refined, but you get the idea ...

Answer 4

This is impossible, as phrased. From what I can tell, I think there are a number of options that you could use to address your problem:

You can chown root or another user and then chmod 700, and then call the script from a cronjob using PHP's command line functionality from the owner's crontab file.

If you need to access the file over curl, then you're hitting the web server, and the web server needs to be able to execute/read the script, which would allow anyone to execute the script.

Another option would be to use rule based access control, as described here: http://library.linode.com/web-servers/apache/access-control/rule-based-access to make sure that only connections originating from your server will be able to access the file in question, but this is itself not entirely ideal.

There are other solutions of course, but I hope this is helpful.