Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Im running a cloud server (Ubuntu 10.04) that hosts 3 sites. Since im not having to worry about shared hosting and other users on the same box. Is there really much risk with chmod 777 a folder so apache can write it? Im trying to avoid a bunch of folders with different permissions.

share|improve this question
8  
It's only single-user until someone breaks in. –  Ignacio Vazquez-Abrams Oct 7 '11 at 0:33
2  
What's wrong with creating a group containing apache and anyone else who needs to write? Or, since there are no other users on the box, just using chown apache on that folder and setting 700? IFAIK, only /tmp should be 777. –  slillibri Oct 7 '11 at 0:47
    
well that kind of the point, if they have access to write, the game is sort of lost already. –  Ryan Mills Oct 7 '11 at 1:02
    
The concept of minimum privilege is always advisable and never more so than on an Internet facing machine. –  John Gardeniers Oct 7 '11 at 1:36
    
Again, not sure why this question was down voted. Basically, it goes against many security concepts, specifically least privilege user (basically the concept that a given user object should only have access to what it needs and nothing more). But, it's really up to you. It's one of those things that if I saw this on a system, I'd really think the previous admin had no idea what they were doing. A public facing server, all the more should be tightly secured. –  mbrownnyc Oct 7 '11 at 2:03

1 Answer 1

up vote 1 down vote accepted

If you allow apache to both write an execute to a folder then a malicious user could upload a file and potentially trick apache into executing it.

So if I have a folder /var/www/mysite/httpdocs/uploads that had 777 permissions then someone could upload a file and then execute it.

lets call this hack.php

<?php
echo system('ls -l /');
?>

By visiting www.mysite.com/upload/hack.php they would get a directory listing of your / folder if apache had read permissions on it.

This is a rather trivial example and could be made much more evil. You do not want both write and execute permissions on folders.

Just because you do not have an explicit upload form does not mean that a hacker could not find a vulnerability to trick apache into uploading their code. By preventing apache from having write access to the folder then Linux would prevent the file from being uploaded even if the website where to have a vulnerability to allow it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.