Preventing from downloading files?

[Whoever]

Why did you chmod your entire VPS to 000?

It was an accident. Now I've got to reinstall my entire container.
EDIT: Holy crap. I fixed it. I went into Webmin, Command Shell, and did chmod 777 /
Thank god.

Would chmod something work for the original issue as well?

1. chmod 777 / does not get you the correct permissions. Instead, it should be (I think)

Code: Select all

chmod 555 /

2. Your webserver needs to have permissions to read the template files. What you need to do is ensure that the templates are not in a directory or subdirectory of your httpd document root (or any other directory that is served by the httpd). Or you could prevent the webserver from serving the .tpl files:
http://lmgtfy.com/?q=apache+prevent+dow ... les+smarty

[TrevorH]

The correct way to fix completely borked systemwide permissions on an rpm based distro is to use rpm.

Code: Select all

for p in $(rpm -qa); do rpm --setugids $p; rpm --setperms $p; done

[LifeMushroom]

But if I move the templates out of my website directory, my code can't access it. It needs to be in that location.

[Whoever]

But if I move the templates out of my website directory, my code can't access it. It needs to be in that location.

You are using PHP, so modify the php script to find it elsewhere.

Or refer to the first link in the search that I suggested:
http://www.smarty.net/forums/viewtopic.php?t=5475

[LifeMushroom]

This doesn't just apply to templates. It applies to other files that you can access.

On my other page, it shows what user is viewing what. And for some reason, it always shows me that some user is viewing files like /favicon.ico, which doesn't exist, or some weird URL that doesn't have anything to do with my site. I suspect this has something due to the fact that apache has full control over my files.

How do I prevent this stuff? For example:

http://rvlution.net/img/logo.png - you can access
http://rvlution.net/templates/pagelayout.tpl - you can't access
http://lmlair.ddns.net/templates/pagelayout.tpl - you can access

I don't want to move it out of the directory. I'm not really getting the things you're saying here.

The correct way to fix completely borked systemwide permissions on an rpm based distro is to use rpm.

Code: Select all

for p in $(rpm -qa); do rpm --setugids $p; rpm --setperms $p; done

When I run this as my non-root user, I get a whole ton of 'Operation not permitted' errors. When I try it with su - or su, I get a bunch of 'Cannot access: no such file/directory' errors.

[TrevorH]

You absolutely must have root privileges to run my command. Since that has rpm change the permissions and ownership of all files belonging to all packages installed on your system, you will get a lot of "no such file or directory" errors for files that are owned by packages but do not exist. On a minimal install that I just tried it on, I got hundreds or possibly thousands of them.

[Whoever]

This doesn't just apply to templates. It applies to other files that you can access.

On my other page, it shows what user is viewing what. And for some reason, it always shows me that some user is viewing files like /favicon.ico, which doesn't exist, or some weird URL that doesn't have anything to do with my site. I suspect this has something due to the fact that apache has full control over my files.

Most browsers will try to download /favicon.ico from any website that the user visits. It's nothing to do with Apache. You will also see robots and attempts to compromise your site.

[LifeMushroom]

This doesn't just apply to templates. It applies to other files that you can access.

On my other page, it shows what user is viewing what. And for some reason, it always shows me that some user is viewing files like /favicon.ico, which doesn't exist, or some weird URL that doesn't have anything to do with my site. I suspect this has something due to the fact that apache has full control over my files.

Most browsers will try to download /favicon.ico from any website that the user visits. It's nothing to do with Apache. You will also see robots and attempts to compromise your site.

/favicon.ico doesn't exist though. It's /img/favicon.ico.
So the browser is doing everything? I just updated by index.php to get a image from dropbox for my footer. Next thing I view online users, it says someone's viewing the dropbox image, even though there's a 99% chance they're not.
Isn't there some chmod way for apache not to access some of my files, so that:
1) Online Users doesn't show that they can see them
2) They can't download the files (like templates)

[Whoever]

This doesn't just apply to templates. It applies to other files that you can access.

On my other page, it shows what user is viewing what. And for some reason, it always shows me that some user is viewing files like /favicon.ico, which doesn't exist, or some weird URL that doesn't have anything to do with my site. I suspect this has something due to the fact that apache has full control over my files.

Most browsers will try to download /favicon.ico from any website that the user visits. It's nothing to do with Apache. You will also see robots and attempts to compromise your site.

/favicon.ico doesn't exist though. It's /img/favicon.ico.
So the browser is doing everything? I just updated by index.php to get a image from dropbox for my footer. Next thing I view online users, it says someone's viewing the dropbox image, even though there's a 99% chance they're not.
Isn't there some chmod way for apache not to access some of my files, so that:
1) Online Users doesn't show that they can see them
2) They can't download the files (like templates)

Just read the answers you have already been given. If Apache cannot read the template files, then your PHP scripts won't work. You need to follow the advice above.