0

As a beginner, I am trying to deploy Flask web app, on a vps server, using Nginx as a reverse proxy and Uwsgi as HTTP server.
After creating a socket file in the web-app's root directory, which is chowned by the user, I noticed that the file-permission is 666.
Just wanted to know should I change it?

  • Why did you use it? What did you hope to achieve? – muru Sep 26 '19 at 12:28
  • @muru: Thanks for replying. It's the default file-permission, so I did not change it. – Mr.President Sep 26 '19 at 12:32
  • If it's the default, then why did you chmod it? O.o – muru Sep 26 '19 at 12:45
  • My bad, I by mistake posted that in the question. I only used chown. Editing the question right now. – Mr.President Sep 26 '19 at 12:49
0

Depends on what it is for, etc. The permissions 666 would show in a ls -l listing as -rw-rw-rw- (readable and writable by the owning user, the owning group, and any other user/process on the system) so anyone with access to the system could read and write to the file.

These permissions are somewhat loose - it isn't often that a file is open like that to all users on a system. Depending on exactly why you need the socket file it may be appropriate, or there may be a better way to only allow access to the user/group(s) that really need to access it.

|improve this answer|||||
  • Thanks for replying. Should I remove both read and write for other users, as I do not want others to read/write or execute it? – Mr.President Sep 26 '19 at 13:22
  • @Mr.President - I would recommend investigating how it is used and by which users/groups and then determine just how to organize things so that you give minimal exposure ... but it really depends on how it is being used. – ivanivan Sep 26 '19 at 13:38
0

Yes, this is probably insecure. This might be secure, when other users cannot access the parent folder (e.g. it has rights like 700 (rwx------)), otherwise everyone can read and write the socket.

But take care, why it is set up like this. When you used some deployment script, it may be written insecure, but fixing the modes may break the deployment, that may depend on the insecure modes for some reason.

|improve this answer|||||
  • I am guessing, I should keep the permission for owning user, owning group and revoke everything for others ( -rw-rw----) ...is it ok? – Mr.President Sep 26 '19 at 13:37
  • I think you may need to use 660 and chown the file for user.www-data (when nginx is in the group www-data), so both the process and nginx can read and write it. – allo Sep 26 '19 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.