Wrong permissions and wrong ownership

Question

I created several websites where some directories are set to the permission 755 and set the owner to "www-data" and group to "www-data".

This is so that I could prevent setting permisson to 777 for those directories and still make them writeable by the webserver for stuff like cache files, user uploads etc.

Now several files in these directories has be injected with malicious javascript code.

What I think after some log research is that the hacker scanned my server and found files with those exact permissions and the where able to edit these files and inject code into them.

It seems my method is VERY insecure since these websites are very different in terms of which applications runs on each website. That makes me think it is not a particular upload script that is insecure, but more something to do with my permission setting.

Do you have any idea how I secure those directories so the server can write in them but malicious javascript code injection is prevented?

• Server OS: Debian Lenny
• Webserver: Apache 2.2
• Programming: PHP 5

Answer 1

Without more information I can't say for sure, but if you want your websever to be able to write to those directories and you have change the ownership to www-data (I asume is the user running apache), 700 would be enough, as the user is already the owner, and it's more secure.

But still if the malware came from an insecure upload script running (that will be running with that user), this measure will not help and you have to fix the script anyway.

Also you should review your php configuration file (usually php.ini) and your apache configuration and tune both to be more secure.

Hope this helps. Good luck.

Answer 2

Your problem is most likely not at the file system level.

If you think the hacker hacked her way into the server and then edited some files you should block the hackers way in to the machine, not just preventing her from editing certain files.

The culprit is probably in your web application. There are lots of interesting things to read at BadwareBusters.org.

Answer 3

Setting owner to www-data make the directories and files writable by your web server. Set this ownership only for directories you want the web server to write to. Configure the server not to run active code from these directories.

The injection likely comes from the active code you are running on your system. You may want to limit access to javascript files only to directories that can NOT be written to by the web server.

Schedule regular malware scans for the directories that can be written to by the web server. This should only be the cache and upload directories.