Question Plesk Permission

[ezra50]

Hello!

I run Plesk onyx with multiple domains. On 1 subdomain i have Nextcloud running.

It runs fine with the default permissions but, if i want to set secure permissions i get a 403 error.

Script i run:

#!/bin/bash
NCPATH=/var/www/vhosts/domain.nl/cloud.domain.nl
NCDATA=/ncdata

htuser='htuser created in plesk'
htgroup='psacln'
rootuser='root'

printf "Creating possible missing Directories\n"
mkdir -p $NCPATH/data
mkdir -p $NCPATH/updater
mkdir -p $NCDATA

printf "chmod Files and Directories\n"
find ${NCPATH}/ -type f -print0 | xargs -0 chmod 0640
find ${NCPATH}/ -type d -print0 | xargs -0 chmod 0750

printf "chown Directories\n"
chown -R ${rootuser}:${htgroup} ${NCPATH}/
chown -R ${htuser}:${htgroup} ${NCPATH}/apps/
chown -R ${htuser}:${htgroup} ${NCPATH}/config/
chown -R ${htuser}:${htgroup} ${NCDATA}/
chown -R ${htuser}:${htgroup} ${NCPATH}/themes/
chown -R ${htuser}:${htgroup} ${NCPATH}/updater/

chmod +x ${NCPATH}/occ

printf "chmod/chown .htaccess\n"
if [ -f ${NCPATH}/.htaccess ]
then
    chmod 0644 ${NCPATH}/.htaccess
    chown ${rootuser}:${htgroup} ${NCPATH}/.htaccess
fi
if [ -f ${NCDATA}/.htaccess ]
then
    chmod 0644 ${NCDATA}/.htaccess
    chown ${rootuser}:${htgroup} ${NCDATA}/.htaccess
fi

Now when I change the file and folder permission to:

find ${NCPATH}/ -type f -print0 | xargs -0 chmod 0644
find ${NCPATH}/ -type d -print0 | xargs -0 chmod 0755

It seems to work again, so the guest/world permission bit seems to be the problem here.
Is there anything I can perform to have the suggested permissions and access the site?

Already tried this question in the Nextcloud community but... no success yet.

Thank you!

 

[Bitpalast]

Why do you consider the default permissions unsecure?

 

[ezra50]

Hello, thanks for your reply. Well I guess having config.php with my database login details open to anyone as in 64"4" isn't a good idea. I could be wrong though...
These permissions are recommended by the Nextcloud community so I'd like to use them. Any idea?

edit:
Also when I have more admin/users on the server i'd rather not have them nose around in my cloud storage files...

Kind regards,

Ezra

 

[Bitpalast]

Generally speaking it should not be a problem to have files set to 644, because "anyone" can only be another SSH user inside your own web space subscription account or an administrator on the host system. These however will be able to read the file content anyway. Other subscriptions cannot access your web space through PHP, web server or SSH (when they are set to chrooted environment). The real hacking danger here comes from unsecure scripts within your own web space, but not from the read permission.

This does not answer your question, I know. I still need to test what is exactly happening, have not done that yet. But for now: You are pretty safe even with +r access for anoymous users.

 

[ezra50]

Thank you for the explanation so far. I have not found a solution so far, nor anyone other then you commenting on it. Would like to get this sorted long term, these permissions worked for me on a clean Ubuntu server before (without Plesk).

Thank you.