1

I read recently in blogs that by default wget on linux is 750, so only root can execute it. I would like to allow users wget and change it to 755, but I read around the web that it is a big security risk..

Improve this question
1
  • 2
    You can't believe everything you read on the Internet. Though I'd love to see one of these blogs.
    – Michael Hampton
    Aug 25, 2012 at 19:12

3 Answers 3

Reset to default
6

Setting the permissions to 755 is no security risk. The security risk is, if you have software installed that have bugs (for example a blogging software, or other dynamic websites) evil people may use wget to download malicious software to your server.

I advice you to use something like grsecurity/rsbac, selinux, ... or to make it simple, just use the permissions right.

Create a group "wget". Do a chgrp wget /usr/bin/wget. Set the chmod to 750. And put every user that is allowed to execute wget into the wget group.

But don't put a service/daemon user into that group (like apache, mysql, ...).

Improve this answer
1

On the CentOS 5,6 and Ubuntu (various) systems I have to hand wget has 755 perms, so 750 isn't the default for all Linux distros.

As to the security risk, wget will allow users to download arbitrary files but so will quite a few other utilities which come as standard.

Improve this answer
1

Wget can be used to download files when one will manage to do code injection. Wget itself is not a problem, but the websites with holes, which allows to run it.

This is security thru obscurity and web app should be secured with SELinux, AppArmor and IPTables, that it's impossible to download files, as one can initiate downloads using PHP functions or other software which can be uploaded to the server.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .