DE

↑ ↓ select, Enter open, Esc close

Find world-writable files and directories

harmlessPermissions and ownershipalle
Adjust the values, the command updates live
user@server
find /var/www/vhosts -xdev -perm -0002 ! -type l -ls 2>/dev/null

Lists all entries that have write permission for others, excluding symlinks, whose permissions do not matter. This should not occur in a webspace, since otherwise any process on the server can drop code there. A typical cause is tutorials that recommend chmod 777 as a blanket fix.

Note: System directories like /tmp are intentionally world-writable, where the sticky bit (t in the permissions) protects them.

Also searched as

  • find files with 777 permissions
  • find world writable files linux
  • insecure file permissions in webspace
  • who set chmod 777

Related one-liners

All in Permissions and ownership

Find files with the SUID or SGID bit

#find / -xdev \( -perm -4000 -o -perm -2000 \) -type f -exec ls -l {} + 2>/dev/null
harmlessPermissions and ownership

Remove write permission for others recursively

$chmod -R o-w /var/www/vhosts/example.com/httpdocs
cautionPermissions and ownership

Secure the permissions of wp-config.php

$chmod 600 /var/www/vhosts/example.com/httpdocs/wp-config.php
cautionPermissions and ownership

Set all directories to 755 recursively

$find /var/www/vhosts/example.com/httpdocs -type d -exec chmod 755 {} +
cautionPermissions and ownership

Set all files to 644 recursively

$find /var/www/vhosts/example.com/httpdocs -type f -exec chmod 644 {} +
cautionPermissions and ownership

Copy permissions and owner from a reference file

#chmod --reference=/var/www/vhosts/example.com/httpdocs/index.php /var/www/vhosts/example.com/httpdocs/wp-config.php && chown --reference=/var/www/vhosts/example.com/httpdocs/index.php /var/www/vhosts/example.com/httpdocs/wp-config.php
cautionPermissions and ownership

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.