Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm not sure what details are relevant, but here is some general context. I'm configuring a Ubuntu 12.04 web server on AWS to process customer payment info before redirecting them to a hosted pay-page, which will not return transaction details for further processing. Pre hosted pay-page processing will involve connecting remotely to our on-premise database so customer info can be verified and account details can be returned for display.

I'm the only one administering the server. The default permissions appear to be 755 for most directories and files, with owners being root:root. In trying to follow the security principle of least privilege, I'm wondering about removing all world read/execute permissions so the Server Root is left with 750, adding myself to the root group to retain usability. I have Apache running as www-data, and I've set permissions for the Web Root to 2750 and owners to root:www-data -- adding myself to the www-data group for usability.

It seems common to change a systems umask from a default of 022 to 027 so anything new created has permissions 750 instead of 755, but I haven't come across anything that talks about making that sort of change "retroactive" for the entire file system. Is this a good idea, and is there a proper way to do it?

share|improve this question

1 Answer 1

Do not do that, your webserver will no longer have permission to read anything on the box. You need permissions from the root of the filesystem all the way up to the directory where the webserver will be reading from.

That is why you don't find anyone talking about doing it, it won't work. Your webserver starts as root, but it immediately changes to another user after binding to the privileged ports.

It won't even work removing the -R. Run chmod 750 / on your box then try to load a web page.

share|improve this answer
    
Thanks. I am new and still learning the basics. So, if my web root /var/www is 750 with owners root:www-data, as long as / and /var have r-x permissions it should work? Or maybe having most of your file system world readable is not a security risk? Maybe I should look more into chroot if I want to accomplish something similar? –  Kevin Feb 22 at 2:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.