3

I have a similar question about default software configuration. For this question i would like to ask

What directories/file permissions should i ensure are set?

Aprrently Is it normal to get hundreds of break-in attempts per day. So i checked what files and folders are writable on a nonroot user. It was all good. Now i need to protect passwords and such so i checked read permissions.

I am kind of horrified. By default my linux distro has /root to be read. Where i set my mysql root password. But then i looked on and saw /etc was readable. Any user could have got into /etc/ssmtp/ssmtp.conf and found the login/password i use for my mail (which cron uses to contact me) and potentially use it to spam everyone and or get my server or domain on blacklist. I set /etc to 750. Will there be any problems with that?

I'm sure other vulnerabilities due to read access. What files/directories should i ensure are not read or writable?

-edit- ok so i changed etc back to 755. But stil, i need to ensure certain folders are not readable. I changed apache and ssmtp. I would like to know others.

2 Answers 2

Reset to default
3

Any file that contains a password or passphrase should be readable only by the user(s) (and group(s) if applicable) that need to access this password. The same goes for files containing any other kind of confidential information.

Most files in /etc need to be world-readable: they are either general system configuration files such as /etc/fstab and /etc/passwd, or configuration files of a specific application. The few exceptions are files like /etc/shadow (user passwords), /etc/sudoers (users having special permissions), /etc/ppp/chap-secrets (PPP passwords), or /etc/ssl/private (directory containing private SSL certificates), and they normally come out-of-the-box with proper permissions. The technical term for making /etc non-world-readable is shooting yourself in the foot. Don't do it, it hurts.

It's rare to have a mail password in the system configuration. Usually, mail uses passwords to authenticate users, not systems, so that password would be somewhere in your home directory. When you use unusual features, you do need to check that you are using them securely (in this case, I suspect you're not using the right tool for the job).

5
  • From memory ssmtp is a minimal forwarding only mail 'server' typically setup to use a smarthost. So the password he is referring to is probably his smarthost authentication info.
    – Arrowmaster
    Mar 8, 2011 at 23:07
  • @Arrowmaster: For my education, is it actually common for a smarthost to require password authentication? In my limited experience, they usually require you to be on the right side of a firewall, or sometimes to have an approved SSL certificate.
    – Gilles 'SO- stop being evil'
    Mar 8, 2011 at 23:10
  • I wasn't even aware that SSL certificates were an option for any 'consumer' accounts that might be used as a smarthost. I have no experience with 'enterprise' smarthosts. Recently I've used a Google account which required password auth. I haven't used my major US ISPs servers in so long that I cant remember if they had any authentication at all, but that is the only case where 'right side of the firewall' might be used.
    – Arrowmaster
    Mar 8, 2011 at 23:25
  • correct, i am using google apps to deliver mail. I dont believe there is a way to setup an auth key. But anyways, ssmtp didnt setitself to 750 so this is something i need to change.
    – user4069
    Mar 8, 2011 at 23:37
  • +1. Is there an example app i can run so i can see it fail and realize i need to change this? ATM, really this user account does is modify files on my webserver. All apps i need to run are typically automatically or done through my root account as typically its to restart services, create users and set permissions.
    – user4069
    Mar 8, 2011 at 23:43
1

I know it's basically the same answer I gave to your other question, but in addition to what Gilles has said, you should use an automated security audit tool like tiger.

If your distro ships a setting by default, and tiger doesn't warn about it, then the setting should be fine. For files and folders you create yourself, you can and should use your own discretion. In my experience and opinion, there are really only a few files and folders that shouldn't be world-readable, and there's almost never a good reason to have anything world-writeable.

2
  • +1 but i like to mention tiger didnt pick up my root being readable and it definately did not pick up /root/.my.cnf being readable. which had my root mysql password.
    – user4069
    Mar 10, 2011 at 3:18
  • 1
    fair enough, but /root being world-readable isn't necessarily by itself a security problem, and if you create a file yourself and put sensitive data in it, you really need to take responsibility for locking it down yourself. You can, of course, edit tiger's rules for future checks/deployments, which is something I do.
    – simon
    Mar 10, 2011 at 5:33

You must log in to answer this question.