Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm setting up a debian box with shared webhhosts. These users don't have ssh permissions, just ftp. The users are allowed to use PHP and I setup suphp for that so the php processes runs under their own user account, etc.

I'm a little bit worried about the security of the system files, especially the /etc folder. I notice that most files in this directory have permissions like:

    drwxr-xr-x  2 root root    4096 Mar  4 20:00 pam.d
    -rw-r--r--  1 root root    1358 Mar  5 00:48 passwd
    -rw-------  1 root root    1358 Mar  5 00:48 passwd-
    drwxr-xr-x  2 root root    4096 Feb 18 14:22 pear
    drwxr-xr-x  4 root root    4096 Apr 29  2010 perl
    drwxr-xr-x  6 root root    4096 Feb 18 14:22 php5
    drwxr-xr-x  2 root root    4096 Mar  4 17:42 phpmyadmin

Are the read-world permissions which debian standard gives the files in /etc really needed? What's the best mask I can give those files? Are there any files in /etc that should be world readable?

share|improve this question

migrated from stackoverflow.com Mar 6 '11 at 23:27

This question came from our site for professional and enthusiast programmers.

add comment

5 Answers 5

up vote 6 down vote accepted

The default permissions are fine, and needed. If you e.g. didn't leave passwd world readable, a lot of user-related functionality would stop working. File such as /etc/shadow shouldn't be (and aren't) world readable.

Trust the OS to get this right, unless you know very well that the OS is wrong.

share|improve this answer
1  
(...and if you go messing with permissions in /etc, have an alternate way of changing it back - even setting incorrect permissions there could make your OS unbootable) –  Piskvor Mar 5 '11 at 11:20
add comment

Nearly all the configuration file needs to be world readable, how do you expect your applications to read them otherwise ?

If you're really that paranoid, you can however create a groups for each application, put the needed users in them and change group owner and permission for the related configurations file. But I think this would cause a lot more harm than good.

The only important file I can think of which don't have world readable permission is /etc/shadow like stated in other comments.

If you want a secure Debian box, I suggest the securing Debian Howto it's a little bit old, but it gives a good overview.

There is also the harden package which create some interesting dependencies and forbid installation of known vulnerable packages.

share|improve this answer
add comment

Everything seams fine except the phpmyadmin directory. Be really careful to protect files so the mysql password do not leak.

share|improve this answer
    
I checked it out and it seems phpmyadmin configured this correctly, the file (config-db.php) in this folder which contains the password is not world-readable. Thanks for the sharpness :) –  Danny Hiemstra Mar 5 '11 at 23:02
add comment

The passwd needs to be world readable so that a few tools can work correctly. Despite its name, the passwords are not stored there, they are stored in the /etc/shadow file which should have the permissions -rw-------. The passwd- file is likely a backup. All other "files" are directories and contain configuration files.

share|improve this answer
add comment

Let's take a step back: If those users only need access to their home directories, most FTP servers have some config setting that only allows access to that directory, and nowhere else (most commonly by using chroot).

For example, in ProFTPd, it's the DefaultRoot directive:

<VirtualHost myhost.example.com>
  DefaultRoot ~
</VirtualHost>

http://www.proftpd.org/docs/faq/linked/faq-ch5.html#AEN524

share|improve this answer
    
Yes you are right and i do use this, althrough i'm afraid people upload a php script to access the file system (i do think suphp disabled this through) –  Danny Hiemstra Mar 5 '11 at 23:00
    
@Danny Hiemstra: As far as I can see, suPHP can be configured to do likewise, using the chroot directive: suphp.org/DocumentationView.html?file=CONFIG –  Piskvor Mar 6 '11 at 9:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.