Im running a cloud server (Ubuntu 10.04) that hosts 3 sites. Since im not having to worry about shared hosting and other users on the same box. Is there really much risk with chmod 777 a folder so apache can write it? Im trying to avoid a bunch of folders with different permissions.
1 Answer
If you allow apache to both write an execute to a folder then a malicious user could upload a file and potentially trick apache into executing it.
So if I have a folder /var/www/mysite/httpdocs/uploads that had 777 permissions then someone could upload a file and then execute it.
lets call this hack.php
<?php
echo system('ls -l /');
?>
By visiting www.mysite.com/upload/hack.php they would get a directory listing of your / folder if apache had read permissions on it.
This is a rather trivial example and could be made much more evil. You do not want both write and execute permissions on folders.
Just because you do not have an explicit upload form does not mean that a hacker could not find a vulnerability to trick apache into uploading their code. By preventing apache from having write access to the folder then Linux would prevent the file from being uploaded even if the website where to have a vulnerability to allow it.
chown apache
on that folder and setting 700? IFAIK, only /tmp should be 777.