0

Scenario

I am making a wordpress plugin for my own sites that needs access to the site's main .htaccess file.

Via an install script I can modify the .htaccess from 644 to 664 which allows my server (apache2) to write to the .htaccess directly.

Question

What I'm concerned about is the limitation of security. Am I opening myself up to a flurry of potential attacks here? If so what is a better suggestion for making my .htaccess writable by wordpress ie. apache?

EDIT

The apache2 user is www-data on one server but is a different user on a different server depending on the host's settings. I need to be prepared for this.

Improve this question
5
  • 1
    WordPress core also writes to .htaccess if it is writable; if it is not, then it notifies the user of what change they need to make manually. You should probably do the same.
    – Michael Hampton
    Sep 6, 2018 at 20:43
  • @MichaelHampton I'm doing that much already. I also include a script for the admin called permissions.sh which rewrites the .htaccess to 0664. I'm just concerned what risk this may open me up to.
    – Jacksonkr
    Sep 6, 2018 at 21:41
  • 1
    If the web server is compromised, the attacker can write to writable files.
    – Michael Hampton
    Sep 6, 2018 at 22:16
  • This question is probably better suited to the WordPress stack? Having .htaccess writable in the first place is no doubt the immediate concern (many on WordPress SE recommend locking .htaccess down so that it is not editable - which means WP can't update the file). Also, if you are distributing permissions.sh - how accessible is this? Is this removed from the server after installation?
    – MrWhite
    Sep 7, 2018 at 17:58
  • @MrWhite I've been to wordpress stack with this and it was apparent rather quickly that the security aspect wasn't going to be entertained, hence why I came to the security pros w my question. The idea with permissions.sh is the that the recursive owner of the WP directory will run it. 1) User downloads git repo for WP plugin 2) user runs permissions.sh 3) user installs plugin from WP dashboard. I MAY be able to chmod to 664, write to files, then use PHP chmod back to 644 but am I overthinking this?
    – Jacksonkr
    Sep 10, 2018 at 16:55

2 Answers 2

Reset to default
1

This is an old question so I'm not sure if it's still relevant, but here's my take on it.

I don't think you're overthinking it as, yes, the file will be writeable. So if anything fishy happens on the server - e.g. an attack which based on changing / creating files on the server, it will be easier for an attacker to compromise the server or adjust certain settings which can be adjusted with .htaccess.

For instance, you can change PHP settings too - like the maximum file upload size and execution times and a host of other configuration values which you don't want changed by an attacker do you? ;)

So my take would be to 440 it and always edit it by hand in a production environment as there it wshould not be required to change it that often anyway (when you're deploying new stuff you change it once to the desired setup and that's it).

In a beta / development environment however, after carefully assessing other security risks, such as what else is on that same server (are there any other sites with sensitive data etc.), you might want to make your developers' life easier by just leaving it at 660 for dev purposes.

Trust that makes sense. OP probably is way over this problem by now, but I hope it helps others stumbling upon this question.

Improve this answer
0

Whatever you do to make the file writable by Apache will have the file writable by Apache.

If you only want a limited set of options that Apache can change, you can create a setuid program to make these changes based on some input that is verified by the program. The program should not be setuid to root but to some user that is only the owner of the file.

Improve this answer
2
  • That user is www-data on one server but is a different user on a different server depending on the host's settings. What can I do in this case? (info also added as an edit to op)
    – Jacksonkr
    Sep 6, 2018 at 18:06
  • If it's a file on a shared hosting site, it is unlikely that you will be able to install setuid files. It is enough to have the file readable by apache, so read on group and other is enough. If you can have your program, it should not be setuid to the Apache user, but to a new user that owns only that one file.
    – RalfFriedl
    Sep 6, 2018 at 18:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .