is it safe to chmod 775/664 with owner www-data:www-data?

Question

To make working with my webserver easiest I am proposing doing something like the following:

sudo chown www-data:www-data /var/www -R
cd /var/www
sudo find . -type f -exec chmod 664 {} \;
sudo find . -type d -exec chmod 775 {} \;

I have my day-to-day user added to the www-data group too.

My question is: is this a foolish/risky permission set? Is giving www-data group those permissions opening my server up?

Thanks Alex

Answer 1

Usually you just want to have upload folders or autogenerated files to be writable by the www-data user.

Anyway, the risk you are opening here is that if your web application has any bug/vulnerability that might allow an attacker to execute code on your server, this code will execute as www-data (the user the apache process is running) and it could completely delete all your websites.

Answer 2

It does sound risky, assuming www-data is the user exposed to the web server - you are essentially losing the write protection afforded by the ACL. The second option (775) will also raise the risk of an attacker being able to remotely run code on you machine.

Answer 3

In itself, no, if your web server is not configured to honor POST requests and such stuff. However, should any bug in the web server or its client scripts arise that allows to write into the filesystem (and, with the number of PHP scripts around, the probability of this happening is 1), your whole content becomes writeable. So: it's risky, and you should consider other alternatives.

Answer 4

You shouldn't allow common users access to this directory. If a user doesn't need to write or execute from that directory they should not be allowed to do so. At a minimum, I would limit the permissions to 755. Only root (or a user with root access) and www-data should be able to write to this directory.

Answer 5

It's not a good idea to have write permissions on the entire folder, the most websites (for example: wordpress, joomla and magento) needs write permission on specific folders (image upload, file upload) A better way is to give write permission on folders and do not allow script (PHP, python) execution, always check if the user is uploading the right content, example, if you website allow an user to upload an image as it avatar, check if it is an image and not a fake image with PHP script inside. And the problem to have write permissions on the website root is if someone finds an vulnerability he could use that to write a new index.php file and 'hack' your website.