homepage Welcome to WebmasterWorld Guest from 54.225.24.227
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Become a Pro Member
Visit PubCon.com
Home / Forums Index / Code, Content, and Presentation / Perl Server Side CGI Scripting
Forum Library, Charter, Moderators: coopster & jatar k & phranque

Perl Server Side CGI Scripting Forum

    
777, how insecure it is?
tntpower




msg:3541765
 10:44 pm on Jan 6, 2008 (gmt 0)

I just installed Movable Type and to make it work, I have to set a blog's site root directory 777. I do not like 777 as it seems very insecure.

Shall I just keep it as it is (777) or switch to another CMS?

(By the way, if I change the owner of that directory to "apache", then the directory can be 755. does it make any difference?)

Thanks,

 

adwatson




msg:3543207
 4:10 pm on Jan 8, 2008 (gmt 0)

I'm no security expert, but I know that 777 is generally bad news (full read/write for any user/group) - but 755 is usually ok, as it gives full rwx only to the owner (apache). In any case it's definitely better than 777.

The Contractor




msg:3543211
 4:17 pm on Jan 8, 2008 (gmt 0)

You normally have to assign 777 to any directory/folder that can be manipulated by a script (adding/deleting/renaming of subdirectories/subfolders where script generated content is stored). I see no problem with this as it's quite common. It's the script files that need security...

phranque




msg:3543665
 1:11 am on Jan 9, 2008 (gmt 0)

apache-owned and 755 permissions would be way better than 777.
i would wonder why the server or MT needs write permission for the root directory.
it would be better to understand and solve the problem securely than to settle for whatever works first.

vincevincevince




msg:3543681
 1:53 am on Jan 9, 2008 (gmt 0)

Your particular server setup will make a large difference to how much of a risk 777 is. A dedicated server with appropriate additional safety measures in place and a good chroot can make it acceptably safe for many people.

Birdman




msg:3543691
 2:17 am on Jan 9, 2008 (gmt 0)

It's bad! You stand a good possibility of being hacked.

The good news is, if you can make Apache(nobody, 99) own the files or directories that get written to, then you can put the directories back to 755.

So, I've basically repeated what phranque said :)

Marty

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Code, Content, and Presentation / Perl Server Side CGI Scripting
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved