hello all, i want to install bbclone in my server, the software requires /var and all subdirectories to have 777 permissions, i wonder if it will be safe do do so. thanks in advance

What?!?!?! That would let all users write and delete logs (/var/log)! Also, if you have named (BIND) configured, the zone files are most likely in /var/named (which could then be modified by users). Oh, and /var/run stores PID files used by daemons to keep track of whether they're already running... Oh, and /var/spool/mail and /var/spool/cron... I could go on forever. Suffice it to say: NO, that is NOT SAFE.

What the heck kind of software requires those permissions? That's insane! No correctly written software should ever require anything like that.

I actually had the same response and I couldn't believe it, so I checked the install howto for bbclone and it does indeed require 777 settings for all the dirs in /var (666 for all the files). I'd have to second chorts feelings that it's crazy to do that. You'd be allowing anyone to read and edit any of the system logs as well as modify any files in webserver directories, CGI scripts etc. You should really think twice before installing that.

Thank you very much guys for your replys, i hope this helps other people to think twice before installing bbclone.

Hopefully this bbclone thing isn't very popular, because that's just an instant rooted box waiting to happen. All you need is one little slip-up on the webserver that let's you write to an arbitrary file, and BOOM. You could write to any files you know are going to be executed or scanned for parameters, like if you have your named.conf in /var/named, or the if httpd.conf is in /var/www somewhere, or any number of other things. Oh, the most blatantly obvious would just be to write to roots crontab. That would just be INSTANT total ownage. Just from one, tiny slip-up any where... httpd would be the most obvious, but perhaps even a malicious mail message could exploit it, depending on what agent is being used to read the mail spool.

Someone should report this junk to BugTraq. That is definitely not software that anyone should be installing.