Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On a privately owned server with one website, is there any reason the files/directories within /var/www can't be group owned by www-data?

My understanding is that security risks with www-data having write access only arise if you have multiple websites running on the same box.

share|improve this question
add comment

4 Answers

up vote 3 down vote accepted

The principle of least privilege applies. Only give users the rights they need and no more.

In this case, if apache is only serving up pages, give the user acct no rights to edit. Possible risks include: changing file content or uploading new one; adding executable code to files, etc. These risks exists regardless of whether it is a single site up multiples. If the application has a need to edit a specific file, restrict permissions changes to that file.

share|improve this answer
add comment

I wrote a simple script for my WordPress site. This script gives Apache only write-access to what it needs to write to. Everything else under the webroot is read-only. I think this is a good step towards a more secure site, and should be practiced.

#!/bin/bash

PATH=/bin:/usr/bin
WEBROOT="/var/www/www.example.com"

UPLOADS="${WEBROOT}/wp-content/uploads"

chown -R nobody:nogroup ${WEBROOT}
find ${WEBROOT} -type d -exec chmod 0555 {} \;
find ${WEBROOT} -type f -exec chmod 0444 {} \;

chown nobody:www-data ${WEBROOT}/sitemap.xml ${WEBROOT}/sitemap.xml.gz
chmod 0464 ${WEBROOT}/sitemap.xml ${WEBROOT}/sitemap.xml.gz

chown -R nobody:www-data ${UPLOADS}
find ${UPLOADS} -type d -exec chmod 2575 {} \;
find ${UPLOADS} -type f -exec chmod 0464 {} \;
share|improve this answer
    
Appreciate the script above (pkhamre) but no luck for me with wp-content/uploads on the equivalent in CentOS. I created my own www-data, since that is not default on CentOS-apache. useradd --system www-data cd wp-content/uploads; chown -R www-data:www-data . usermod -a -G www-data apache //thinking I'm going to let apache write files with sguid //still in wp-content... find . -type d -exec chmod 2575 {} \; find . -type f -exec chmod 0464 {} \; I also tried chmod 3575 on the directories as this sets sticky as well as setgid ...no luck, meaning wordpress still fails to upload media. Any ideas? –  user162578 Mar 2 '13 at 6:21
add comment

Even if you have only one website, compromising apache user will enable the hacker to change the files under /var/www if the folder is writable by apache user.

share|improve this answer
    
What if certain folders of my site need write access? Would you just change the ownership to www-data on those specific folders, leaving everything else as owned by a web developer account/root? –  Trent Scott Apr 25 '12 at 14:29
2  
You can change only the needed folders such as the folders that need to get uploaded files. –  Khaled Apr 25 '12 at 14:30
add comment

I wouldn't see why not. If there is one site, this should be ok. But do mind you might want to grant read only to some files. (well whitelist if they need write access :) )

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.