Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm using Ubuntu 10.04 and installed apache2 HTTP server.
On the security page @ apache.org documentation they recommend to change the permissions on the file /usr/local/apache/bin/httpd to 511, but I don't understand why ?

Why shouldn't the root user be able to write to that file?

The current configs for that file are:

/usr/lib/apache2/mpm-prefork$ ls -l
total 1412
-rwxr-xr-x 1 root root 1443482 Apr 13 23:23 apache2

Do my current configs for the apache2 binary file considered dangerous?

(Note that in Ubuntu the file path is /usr/lib/apache2/mpm-prefork/apache2 and not /usr/local/apache/bin/httpd)

share|improve this question

2 Answers 2

up vote 2 down vote accepted

root will always be able to write to the file. I would assume this is aimed at cases where the apache user owns the binary. In this case, it makes sense since it prevents an exploited apache from replacing itself with a dodgy binary (also if you're on ubuntu, you're almost certainly using apache2.2 instead of 2.0, and should read the docs from that instead).

share|improve this answer
    
But if Apache is badly exploited and the binary is owned by the apache user, surely it can somehow chmod itself before replacing? Yes, yes, security is like an onion, built from multiple layers, but still ... –  Janne Pikkarainen Aug 27 '10 at 8:44
1  
Yup, it can. Which is why I'd just have it owned by root. –  Cian Aug 27 '10 at 8:53
    
I'd rather make chown a command which only root can execute (probably needs a kernel patch but still). –  Aaron Digulla Aug 27 '10 at 10:06
    
It is alredy, isn't it? lil_cain@minerva:~$ chown receive:root test chown: changing ownership of `test': Operation not permitted –  Cian Aug 27 '10 at 11:01
    
chown can be run by any user; and they can override (certain) file permissions if they have appropriate permissions for the folder the file is in. httpd should be owned by root, and 511 perms. –  Chris S Aug 27 '10 at 20:41

The best option here is to disable logging in as root, this will narrow the attack potential that is brought up in the comments to Cian's answer. Additionally root can always write anywhere it pleases. Perhaps a more secure chmod strategy would be 500, since this disallows world from executing on it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.