2

I use to have owned php scripts on a dedicated server by user "webroot".

It would be easier for coding and administration if the scripts were owned by the apache2 user, "www-data" on my system. Also feels more simple and clean.

There is no ftp on this box and there are no other users or sites.

Why not have the php scripts owned by www-data? If there is anything against it, what is the worst that can happen?

Improve this question

4 Answers 4

Reset to default
1

I strongly not recommend using apache user as the owner of the files for security reasons. If one of your apache php scripts is compromised it will be able to write on any file owned by apache.

You should use the ownership to apache user strictly for files that you need to be changed by php.

Improve this answer
0

Sounds like you use Ubuntu (like flavor as they use the www-data user)

I would recommend always to let the apache user and group (set in httpd.conf or apache.conf) be the owner of your website files.

I prefer using apache:apache though

Improve this answer
1
  • Yes, Ubuntu here. Apache is indeed a better username.
    – user12096
    Mar 31, 2010 at 13:14
0

The danger is that a script or the web server could be compromised, allowing an attacker to write PHP files to your server. How realistic that threat is depends on things like if your scripts allow the uploading of files (and how well they check their file types) and what software is running. Security isn't a yes/no either/or proposition -- one typically looks for opportunities to make a server more secure in many different places. Unfortunately it is almost always the case that security is at odds with convenience.

Improve this answer
2
  • The point is if the files and directories are owned by apache, php cannot write them? So the weak point is php's upload function? And what if the upload function would somehow be secured or disabled?
    – user12096
    Apr 26, 2010 at 9:27
  • if PHP is running as mod_php, then it will be running as apache or whatever the web username is. One reason some people run PHP as a CGI, which is slower, is that you can set it to a different user. The upload is just one week point - the question is executing code you didn't intend to execute and uploading a php file and all the other scripts are running as the same user, then I can use my one script to modify the others.
    – Devin Ceartas
    Apr 28, 2010 at 0:50
0

The argument against having the same user own the files and run the httpd process would be that if your apache instance was compromised, the attacker could modify the files in your docroot.

Like usual, security and ease-of-use are at odds, so you'll have to make the call depending on your environment.

This article on apache and file ownership/permissions is a bit old, but the same principles still apply

http://onlamp.com/pub/a/apache/2004/05/28/apacheckbk.html

Improve this answer
2
  • So this is different from Mircea Vutcovici's aspect? You say apache could be compromised (how that, isn't it ment to be secure?) and Mircea says the php scripts could be compromised?
    – user12096
    Apr 26, 2010 at 9:25
  • I believe Mircea and I are trying to say the same thing. Even a "secure" Apache instance could be compromised by an insecure php script.
    – micah
    May 3, 2010 at 15:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .