Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If you are installing Joomla via cPanel's File Manager to your mywebsite.com (user mywebsite) account, you will upload the package to your server and extract the archive. All files will have the user and group according to your account mywebsite:mywebsite. You will have to change around three dozen directories and files and make them writable: http://goo.gl/EYjIPW and you can go ahead with the installation. All files created during the installation and later, using the Joomla platform will have the user and group nobody:nobody.

If you chown all extracted files to nobody:nobody, prior to installation, you won't have to bother about making the above-mentioned directories writable plus more than likely you will not run into any "Permission denied" errors later (changing the owner can be done after the installation as well).

The question, do you know any drawbacks of having the files owned by nobody:nobody? What are the pros and cons? And what about the files that are created by Joomla during and after the installation, these are by default owned by nobody:nobody.

share|improve this question

1 Answer 1

Some daemons traditionally use nobody, so that if they are comprimised, the access they have is limited. If you start assigning files to the nobody user, then if you do have a daemon running as that user, and it was comprimised in some way, then the attacker could potentially gain access to the files. Given that the files are a website, and Joomla configuration files contain the database details in plaintext, this could be pretty disastrous for you.

It doesn't seem like a good idea to me, even if daemons that run as nobody are rarer nowadays - the idea of user per daemon allows for greater security against daemons communicating with each other spuriously.

share|improve this answer
    
Thank you @Owen, this is the reason I asked, doesn't seem right to me to have all files under the nobody user, server-wide, all accounts. However, all files created by Joomla on a cPanel server (default settings) are owned by nobody:nobody and configuration.php is created by Joomla, right after the installation. Meaning, all configuration.php files on a server (that may host 100+ Joomla websites) are owned by nobody. Does it make any sense to chown at least these files to owninguser:owninguser ? –  Yatko Dec 3 '13 at 18:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.