Writeable web content

bmzink · 03-06-2006, 08:04 AM

Hello,

I have some web content purchased from a vendor who designs e-commerce solutions. When the development was done they sent me the content on a CD.

There are 3 directories that need to be writeable by the webserver. What is the proper way to set these permissions so that this site is secure but still functional.

Please be detailed as far as group membership ideas as well.

Thank you,

Brett

TigerOC · 03-08-2006, 03:10 AM

Quote:

Originally Posted by bmzink

Hello,

I have some web content purchased from a vendor who designs e-commerce solutions. When the development was done they sent me the content on a CD.

There are 3 directories that need to be writeable by the webserver. What is the proper way to set these permissions so that this site is secure but still functional.

Please be detailed as far as group membership ideas as well.

Thank you,

Brett

Any developer worth his salt should have given you the necessary info on what is required on this issue. If the system is a php/mysql based package I strongly recommend that you implement mod-security into your apache server. Details available at www.modsecurity.org . Personally I would be very cautious with implementation of effectively untried and untested packages with little or no security track record because anything that is not secure will make you very vulnerable.

bmzink · 03-08-2006, 06:57 AM

Thank you for the reply, I'm looking into modsecurity right now.

You're right the developers should be providing me with these details but they haven't been. When I asked them I was told that the subject was beyond the scope of technical support. Needless to say I haven't been happy with them ever since we paid the bill.

If anyone else has any input on this it would be greatly appreciated.

Thank you,
Brett

TigerOC · 03-08-2006, 03:51 PM

I am no expert on this and have only one such program running on my system but the files that are written to are outside the document root and have 777 permissions. In this scenario you would need to set the configuration files so that they know where to find the files. Having them outside the document root (/var/www) means they are not exposed to or searchable by visitors and those with evil intent. Ownership would be assigned to the apache user.