2

Some programmer told me that my usual way to change ownership and permissions to my webapp dirs isn't good:

sudo chown www-data:www-data /var/www/html/* -R

He told me that this could result in a state when malicious CMS modules affect molecularity of adjacent webapps with the same owner.

I think that this is a good solution

1) When I create a new webapp:

sudo chown -R ${domain}:${domain} ${domain}/*

2) When I change an existing webapp:

cd /var/www/html && sudo chown -R $<domain.tld>:<domain.tld> domain.tld/*

My qeustion

My question is comprised of the following two questions:

  1. Was the programmer right?
  2. How should I add user in a safe user to give it as owner and group? (not sure if to pick useradd/adduser and with what permissions, for that purpose.
  • Worth noting if the application does not need ownership or write access to a file then it shouldn't be granted. – Hector Jan 16 '18 at 21:28
2

I don't think the suggestion is particularly to have the same value as the user and group as the directory name, but rather to have a single user/group for each directory.

If you use www-data for all cases, then a compromise of a single site (or malicious site owner in the case of shared hosting) can easily read & write files into the other site directories.

Having multiple users (one per site, for example) mitigates the damage in a compromise. Typically, you'd want www-data for the group (and group readable, but not writable permissions) so your webserver can read all of the static files, and to run a per-user instance of your application server. (For example, one php-fcgi or python gunicorn instance running as each site owner, for the appropriate language.)

You can use adduser, but I would use both the --disabled-password and --disabled-login flags to ensure that the new user does not also become an attack vector!

  • Indeed, the suggestion is as you describe it. I just think that make the owner identical to site dir is minimal and likely to be efficient. – Arcticooling Jan 16 '18 at 22:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.