'find . -exec chmod 700 "{}" \;' made sites Forbidden

Question

I have been reading about Security of Design. I noticed a tip of lowest permission level. So I did the above code to my junk files. Unfortunately, the junk-folder seemed to contain some server files. A few sites become forbidden. The folder contained stuff such as "Mail", "dev" and "Public". The reason for junking them was that they are empty.

The files are located in a server of a CS-dept. There is no special CMS or anything like that. Before running 'chmod 644 some_files', I am promth to ask your opinion.

Why did the sites become forbidden? What are the lowest permission levels?

Answer 1

Most likely the owner of the folders that are forbidden is another than the ones that are available. The user that runs the file or it's group must have read (and sometimes executable) permissions on the files/folder. Since you removed the read, write and executable privileges on the group and the world no one but the owner of the files will be able to run them.

TLDR: Wrong owner of file/folder. chown to correct user.

Answer 2

The web server usually runs as a different userid from "real" users. So you make it so that a "real" users files aren't readable by anybody else, and the web server can't read them. That's why 744 is a better permission set for files the web server needs to see.

Answer 3

Lowest possible permission level is of course 000. But that wouldn't make much sense.

• 600 rw------- for private files
• 700 rwx------ for private directories
• 711 rwx--x--x for directories with public files, but without permission to list dir
• 644 rw-r--r-- for publicly readable files
• 755 rwxr-xr-x for publicly readable dirs

Answer 4

Your problem: your user account does not have execute permissions for the rest of the world.

Solution: You need to put the permissions 701 for your user folder. You can also set them to 711. It is the folder which contains your public_html etc.

Then, check that your public_html has the permissions 755. Similarly, the contents should also be 755 in public_html.