7

Are there any significant security concerns about adding users to the apache group? I am a programmer and I need access to all the files/directories in httpdocs - is there anything wrong with adding my user to that group?

2 Answers 2

6

In your situation you do not want to do this as your intentions pose a significant security risk.

The Apache user/group should only have read access to the files in the web root. If your apache user has write access then you are open to having your application exploited and since it is running under a user that has write access, the attacker now has write access to your system.

I assume when you say that you need 'access' you mean that you want to write to the files. If you were going to achieve this by making yourself a member of the apache group, that would not meet your goal because (assuming you're running good permissions to begin with) your apache group does not have write access to the web files. You would also have to allow the group to write to the files in order to achieve what you want and then you're open to the type of attack I described in the second paragraph.

You should create a new group (www-admins or something) that has write access to those files and then add yourself to that group instead.

4
  • complete, 100% agreement ... Apache should not have write access to the document root. If you're running PHP or similar CGIs that allow uploads that are then served, you might have a limited directory they can write to, but you need to make sure that PHP won't interpret files in there, unless you really like your server being compromised and having to blank it and reinstall. (and you're still at risk for being used as a dropbox for online drugstore ads, PDFs with exploit code, etc.)
    – Joe H.
    Oct 3, 2011 at 20:31
  • I'm with you so far, please help me understand a little more: The files in question are primarily extensions to the Joomla CMS, so a PHP page is unpacking a .zip file and copying the contents throughout the web directory. So I guess it must be the Apache user that executes the PHP scripts, right? This ends up making it hard for a developer (Yours Truly) to edit these files. Should the PHP page run under a different user or should the developer have different permissions?
    – doub1ejack
    Oct 4, 2011 at 16:05
  • What are you using to connect? If SCP/SSH then you need to be either the owner of the files or you need to be in the group that owns the files AND the files have to writable by the group. If you're using FTP, then things are a little harder to explain because various FTP clients elevate their users privileges in a variety of ways.
    – jdw
    Oct 4, 2011 at 17:02
  • Using SSH primarily.
    – doub1ejack
    Oct 4, 2011 at 20:53
1

If you add apache user to your group - this is bad.

If you add you to apache group - where is a problem ?

3
  • 2
    Because he's not only intending to add himself to the Apache group but he's also going to have to give the Apache group write access to the files order to achieve what he wants. Therefore Apache itself will have write access which is a security issue for the reasons I described.
    – jdw
    Oct 3, 2011 at 22:54
  • This seems spot on. My user was added to the Apache group, but is still not able to edit the files belonging to Apache. Which, I gather, is how things should be - I promise not to change that.
    – doub1ejack
    Oct 4, 2011 at 15:55
  • @KorjavinIvan - Would you mind explaining why it's bad to add the apache user to your user's default group? (I don't disagree with you; I just don't know, and I'd like to learn.) Apr 30, 2014 at 2:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .