Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a web application needs write access to certain folders on a LAMP server.

Since suPHP / suEXEC escalate operations to an account you specify, it seems like your server is no more secure because a hacker could still compromise your site (you just get to pick the user).

Is this any more secure than granting www-data write access on those specific files / folders?

share|improve this question
up vote 3 down vote accepted

Keep in mind, suexec does not eliminate all security problems, and deals only with a very small subset of issues. You mention that a hacker could still compromise your site, but as a different user--which is true. But consider this--on a shared hosting environment, where all the Apache instances are running as www-data, an exploited Apache process now has access to everything www-data has, which likely spans multiple users.

So if you had a user that could ONLY view its own files, had a jailed shell (if the hacker was able to exploit and login as the user), disabled login, etc., then exploiting that user, specifically, would have only a limited effect. The purpose here is not to prevent hackers from getting in, but to limit their damage once they are. Since CGI can be exploited, it still falls on your shoulders to make sure that your scripts are still secured.

share|improve this answer
Thanks for your answer. That confirms what I thought. On a private server (only my websites), is there anything wrong with granting www-data access to folders that need it? Seems like suEXEC won't really help when there's only one website and it belongs to me. – Trent Scott Apr 25 '12 at 16:29
There won't be a huge benefit in your case, from the sound of it, no. – Andrew M. Apr 25 '12 at 17:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.