Raffaele Morelli wrote:
> Bob Proulx wrote:
> > 2) The ownership of the files by root are safe. The default owner is> Quite wrong.
> > root. Files owned by root with the default permissions are not
> > writable by the web process. Files in the default configuration are
> > not exploitable by that vulnerability which requires write access to
> > files in the DocumentRoot. There is never a problem with web files
> > owned by the root user.
>
No. This is correct. If you disagree then please file a bug report.
Please let me know where it is filed so that I can participate in the
review. Peer review is the best way to deal with it.
Why are you responding here with this? I never said that creating a
> Unless you are administering your own server with just you as user there's
> no problem in using root for everything.
> But if you have other users you should grant write permissions to the
> website document root for them to upload stuff and simply you can't let
> anyone other than you to access as root (would you?).
> Now, rwx permissions and unprivileged users exist for that, root ownership
> is absolutely not needed.
non-priviledged and non-www-data account to hold the files was bad.
Why are you responding as if I did? Please read the thread again. I
repeatedly said creating such users were a good way to do things.
Here I was discussing the reason the exploit was successful. The
exploit allowed the attacker access to the system as the www-data
user. Because the files were owned by the www-data user it allowed
the attacker to write files. The ability to write files gave the
attacker even more capability in this case to generate spam from the
server. The ability of the attacker to write files enabled the
attacker to leave more doors open even if the original exploit was
closed until the attacker's files are cleaned up.
If the files were not owned by the www-data user then while the
exploit may still have occurred then the attacker would have been
prevented by the OS from writing files into the DocumentRoot. This
would likely have prevented the compromised host from becoming the
spam source that it was reported to have become. Because it would
have limited the attacker to the original exploit and prevented the
attacker from created expanded capabilities by adding files on disk.
No one has proposing using root for everything. That would be very
> Unless you are administering your own server with just you as user
> there's no problem in using root for everything.
bad. Why do you respond as if someone did?
Bob