Hi,

I'm running a LAMP server using PHP Version 5.3.2-1ubuntu4.2 on ubuntu 10.04. Does anyone know what the default permissions are for the session folder (defined in php.ini)? I modified these recently to 777 because of a warning I periodically received; however, this warning didn't hinder the site's functionality at all. I was reading a few articles, and a 777 permission allows for session hijacking; so I would like to revert to the original configuration. I think it was 766 from what I could remember, but setting the session folder to 766 throws the following warnings:

[Tue Jul 20 16:15:24 2010] [error] [client x.x.x.x] PHP Warning: session_start(): open(/path/to/folder/sess_neruoouifriqvrspo41hllg7m4, O_RDWR) failed: Permission denied (13) in /var/www/index.php on line 3, referer: https://www.example.com/
[Tue Jul 20 16:15:24 2010] [error] [client x.x.x.x] PHP Warning: Unknown: open(/path/to/folder/sess_neruoouifriqvrspo41hllg7m4, O_RDWR) failed: Permission denied (13) in Unknown on line 0, referer: https://www.example.com/
[Tue Jul 20 16:15:24 2010] [error] [client x.x.x.x] PHP Warning: Unknown: Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/path/to/folder) in Unknown on line 0, referer: https://www.example.com/

When I

exec('whoami');

I get

www-data

. So I attempted the following:

chown root:www-data /path/to/folder -R

But still no cigar. What is the best practice for setting up php session permissions and how do I go about accomplishing that? Thank you very much for any help in this matter

Sincerely,
Max