2

Some programmer told me that my usual way to change ownership and permissions to my webapp dirs isn't good:

sudo chown www-data:www-data /var/www/html/* -R

He told me that this could result in a state when malicious CMS modules affect molecularity of adjacent webapps with the same owner.

I think that this is a good solution

1) When I create a new webapp:

sudo chown -R ${domain}:${domain} ${domain}/*

2) When I change an existing webapp:

cd /var/www/html && sudo chown -R $<domain.tld>:<domain.tld> domain.tld/*

My qeustion

My question is comprised of the following two questions:

  1. Was the programmer right?
  2. How should I add user in a safe user to give it as owner and group? (not sure if to pick useradd/adduser and with what permissions, for that purpose.
1
  • Worth noting if the application does not need ownership or write access to a file then it shouldn't be granted.
    – Hector
    Commented Jan 16, 2018 at 21:28

1 Answer 1

2

I don't think the suggestion is particularly to have the same value as the user and group as the directory name, but rather to have a single user/group for each directory.

If you use www-data for all cases, then a compromise of a single site (or malicious site owner in the case of shared hosting) can easily read & write files into the other site directories.

Having multiple users (one per site, for example) mitigates the damage in a compromise. Typically, you'd want www-data for the group (and group readable, but not writable permissions) so your webserver can read all of the static files, and to run a per-user instance of your application server. (For example, one php-fcgi or python gunicorn instance running as each site owner, for the appropriate language.)

You can use adduser, but I would use both the --disabled-password and --disabled-login flags to ensure that the new user does not also become an attack vector!

1
  • Indeed, the suggestion is as you describe it. I just think that make the owner identical to site dir is minimal and likely to be efficient. Commented Jan 16, 2018 at 22:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .