Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a web application needs write access to certain folders on a LAMP server.

Since suPHP / suEXEC escalate operations to an account you specify, it seems like your server is no more secure because a hacker could still compromise your site (you just get to pick the user).

Is this any more secure than granting www-data write access on those specific files / folders?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

Keep in mind, suexec does not eliminate all security problems, and deals only with a very small subset of issues. You mention that a hacker could still compromise your site, but as a different user--which is true. But consider this--on a shared hosting environment, where all the Apache instances are running as www-data, an exploited Apache process now has access to everything www-data has, which likely spans multiple users.

So if you had a user that could ONLY view its own files, had a jailed shell (if the hacker was able to exploit and login as the user), disabled login, etc., then exploiting that user, specifically, would have only a limited effect. The purpose here is not to prevent hackers from getting in, but to limit their damage once they are. Since CGI can be exploited, it still falls on your shoulders to make sure that your scripts are still secured.

share|improve this answer
    
Thanks for your answer. That confirms what I thought. On a private server (only my websites), is there anything wrong with granting www-data access to folders that need it? Seems like suEXEC won't really help when there's only one website and it belongs to me. –  Trent Scott Apr 25 '12 at 16:29
1  
There won't be a huge benefit in your case, from the sound of it, no. –  Andrew M. Apr 25 '12 at 17:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.