I'm setting up a debian box with shared webhhosts. These users don't have ssh permissions, just ftp. The users are allowed to use PHP and I setup suphp for that so the php processes runs under their own user account, etc.

I'm a little bit worried about the security of the system files, especially the /etc folder. I notice that most files in this directory have permissions like:

    drwxr-xr-x  2 root root    4096 Mar  4 20:00 pam.d
    -rw-r--r--  1 root root    1358 Mar  5 00:48 passwd
    -rw-------  1 root root    1358 Mar  5 00:48 passwd-
    drwxr-xr-x  2 root root    4096 Feb 18 14:22 pear
    drwxr-xr-x  4 root root    4096 Apr 29  2010 perl
    drwxr-xr-x  6 root root    4096 Feb 18 14:22 php5
    drwxr-xr-x  2 root root    4096 Mar  4 17:42 phpmyadmin

Are the read-world permissions which debian standard gives the files in /etc really needed? What's the best mask I can give those files? Are there any files in /etc that should be world readable?


The default permissions are fine, and needed. If you e.g. didn't leave passwd world readable, a lot of user-related functionality would stop working. File such as /etc/shadow shouldn't be (and aren't) world readable.

Trust the OS to get this right, unless you know very well that the OS is wrong.

  • 1
    (...and if you go messing with permissions in /etc, have an alternate way of changing it back - even setting incorrect permissions there could make your OS unbootable)
    – Piskvor
    Mar 5 '11 at 11:20

Nearly all the configuration file needs to be world readable, how do you expect your applications to read them otherwise ?

If you're really that paranoid, you can however create a groups for each application, put the needed users in them and change group owner and permission for the related configurations file. But I think this would cause a lot more harm than good.

The only important file I can think of which don't have world readable permission is /etc/shadow like stated in other comments.

If you want a secure Debian box, I suggest the securing Debian Howto it's a little bit old, but it gives a good overview.

There is also the harden package which create some interesting dependencies and forbid installation of known vulnerable packages.


Everything seams fine except the phpmyadmin directory. Be really careful to protect files so the mysql password do not leak.

  • I checked it out and it seems phpmyadmin configured this correctly, the file (config-db.php) in this folder which contains the password is not world-readable. Thanks for the sharpness :)
    – Danny Hiemstra
    Mar 5 '11 at 23:02

The passwd needs to be world readable so that a few tools can work correctly. Despite its name, the passwords are not stored there, they are stored in the /etc/shadow file which should have the permissions -rw-------. The passwd- file is likely a backup. All other "files" are directories and contain configuration files.


Let's take a step back: If those users only need access to their home directories, most FTP servers have some config setting that only allows access to that directory, and nowhere else (most commonly by using chroot).

For example, in ProFTPd, it's the DefaultRoot directive:

<VirtualHost myhost.example.com>
  DefaultRoot ~


  • Yes you are right and i do use this, althrough i'm afraid people upload a php script to access the file system (i do think suphp disabled this through)
    – Danny Hiemstra
    Mar 5 '11 at 23:00
  • @Danny Hiemstra: As far as I can see, suPHP can be configured to do likewise, using the chroot directive: suphp.org/DocumentationView.html?file=CONFIG
    – Piskvor
    Mar 6 '11 at 9:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.