Hi all,

I have a question about permissions and owners.
I have installed apache2. This uses www-data as user and group. I chgrp and chown /var/www changing from user and group "root" to user and group "www-data".
And I chmod-ed to 755 permissions on /var/www
Now I doubt if this is secure or not...

I thought if someone can get out of apache with an exploit, he could change/delete/... files. But normally it is root, which should be even more dangerous :s so now I'm a little confused.

I'm waiting for what the experts have to say about this

Greetings

of course security depends on many more factors, but yes, you're okay as far as DocumentRoot permissions...

an apache remote exploit will typically result in the attacker being able to execute code as the user apache is running as (www-data in your case)... this limits what they would be able to do to your system if compromised... for the attacker to gain higher privilages (such as root), he will need to proceed with a local exploit - which he may or may not have...

one way people deal with this kind of concern you have is by running apache in a chroot jail... there's lots of info about this on the web: http://www.google.com/linux?hl=en&q=apache+chroot

many administrators even take chroot a step further by using hardening tools such as those available from: http://www.grsecurity.net/

and if you're running web applications, make sure you look at: http://www.modsecurity.org/

apache is started as root, but it switches to the non-root user right away... you can check with a "ps aux" that only the apache parent process is being run by root, while all the children are run as the non-root user...

here's some apache2 security tips: http://httpd.apache.org/docs/2.0/mis...rity_tips.html

thank you for your response... I will take a look at those links.

EDIT:
I'm still a little confused. What I want to do is having 2 people who are able to copy files from there homedirectory to the DocumentRoot and folders beyond, they maintain the website. I chowned en chgrped the DocumentRoot and added them to the www-data group.
But now, I have to put 775 permissions. Otherwhise those 2 accounts (who I added to www-data group) can't change the files. But someone who can get out of apache (with an exploit) can then remove all files in the DocumentRoot.

How can I fix this? And is it better to keep the user and group "root"?
How can I achieve what I want to do as explained above?

Greetings!

one way would be with a cron job that creates backups of the files every so often... hence:

1 --> apache is cracked, files in DocumentRoot are deleted...

2 --> logs are inspected; method of entry is determined; system is re-installed and hardened; backups are restored to the way they were prior to the crack...

3 --> life goes-on...

well, having your DocumentRoot with root:root perms would guard the files if apache is exploited and no privilage-escalation is achieved by the cracker... but AFAICT it would cause more serious issues regarding the permissions your 2 users would then need... my suggestion is to leave things with www-data and go the way of the periodic backups... of course, my apache experience is limited, so you might wanna wait for someone else's opinion on this too...