Which access rights should be chosen for doku wiki?

Question

I'm currently making my first experiences with a CMS called "DokuWiki" (Link). This CMS needs only PHP and writes the information to files (seems to be /dokuwiki/data/pages).

At the moment I gave the whole dokuwiki-folder + subfolders and files the rights 777. I am the owner of the files / folders.

Which access rights should be given to the folder? Should I change the owner (e.g. to www-data)?

Do you know any attack based on to many rights for folders/files? I could only imagine an attack which uses a PHP vulnerability to get access to the filesystem and then uses the rights to do harm.

edit: I've just found install:permissions. Is my assumption right, that the following set of permissions is the minimum needed by DokuWiki to run?

$ sudo chown www-data -R /var/www/wiki
$ sudo chmod 400 /var/www/wiki -R
$ sudo chmod 600 /var/www/wiki/data -R
$ sudo chmod 600 /var/www/lib -R
$ sudo chmod 600 /var/www/conf -R
$ sudo chmod 700 /var/www/wiki/data /var/www/wiki/data/tmp /var/www/wiki/lib var/www/wiki/lib/plugins /var/www/wiki/conf

Answer 1

Generally the best practice for web site permissions are to give the web user, in your case www-data, read, but not write, access to the data files. That is, something similar to:

chown root:www-data -R /var/www/html
find /var/www/html -type d -exec chmod 750 {} \;
find /var/www/html -type f -exec chmod 640 {} \;

The goal is to allow the web server application to read the files, but not be able to write anywhere. That way if the web service itself is compromised we have limited a malicious user's ability to drop arbitrary files. (Read up on chroot as a corollary, but is outside the scope of this answer).

Wikis, by their nature, must violate this practice for them to properly function. However, the key is to understand exactly which parts of the wiki software need higher privileges. In order to really decide, you have a choice:

1. Use the web interface for creating/editing pages only.
2. Use the web interface for creating/editing pages, as well as managing configurations.

Option 1
This will set up all of the file level permissions such that users can edit/create pages, but it will require you to manage configurations manually. If you (or whomever manages the wiki) feel comfortable with PHP syntax, and don't mind working on the config files then this is probably your best bet. So your permission set should look like:

chown root:www-data -R /var/www/wiki  
chmod 750 /var/www/wiki -R
chmod 770 /var/www/wiki/data -R
chmod 750 /var/www/lib -R
chmod 750 /var/www/conf -R
find /var/www -type f -exec chmod -x {} \;

So what we've done here is given root read/write and www-data read only to all wiki files. Then given www-data the additional rights to write to the user data section.

Option 2
If you also want to manage the configs through the web interface then use the same setup as above, except swap out line 5 for:

chmod 770 /var/www/conf -R

Disclaimer: I've never run DokuWiki setup like this, but I don't see any reason why it won't work. Test it out first, eh?

Answer 2

I don't know Dokuwiki at all, and the best insight is in setting permissions too low and then having to upgrade them. But.. I'm not sure why you need read & write on the library and conf directories and files? I would think that read only on the libraries would be preferable and on the configuration files, too. The tool shouldn't be changing it's own configuration...