File System Permissions for Apache

I don’t spend a lot of time on The Apache HTTP Server Users mailing list, but a discussion sprang up there this week on which I think I should share my response. The issue was why the server in question did not have permission to show a particular file. The initial response was “just chown your document root to the Apache user” and, when pointed out that this introduced security issues,

Oh man an experienced sys admin told me to do it that way.
Please tell me what is wrong in this and where is this documented on Apache 
docs.
I want to read.

Here is my response reproduced: read on.

The Apache HTTP Server needs read access to its configuration files and the files it serves. In and of itself, the server does not need write access anywhere on the system: even its log files are opened for write when the server is still root, and the open file descriptors passed to the child processes which change their user id to the lesser privileged user.

Read access only. The web server user should not own, or be able to write to, its configuration files or content.

Content, other than CGI scripts, generally does not need Execute permissions. Even PHP files that are interpreted by the server do not need to be Executable.

Certain applications, especially publishing platforms and Content Management Systems that you manage and populate through the web server itself using a browser, require that certain directories on the system be made writable by the web server user. You can do this by changing the owner of the directory to that user (usually www but ymmv), or by making the directory group-writable and changing the group to the group as which Apache runs.

Making directories writable by the web server should be done only with care and consideration. The usual threat model is that someone manages to upload (for instance) a PHP script of their own making into the document root, and simply executes that by accessing it through a browser. Now someone is executing code on your machine. Google for ‘r57’ for an example of what such code can do.

If a web app needs writable directories, it’s often better to have those outside the DocumentRoot: that way the uploads can’t be accessed from the outside through a direct URL. Some applications (WordPress for instance) support this, others do not.

In many cases, writable directories are not strictly necessary even though the web app might like them: rather than upload plugins (which contain code that gets executed or interpreted, yech!) through the web browser, upload them through ssh and manually unpack them on the server. The CMS Joomla! likes to write its configuration file to the Document Root on initial install (which promptly becomes a popular attack target) but if it can’t write to the Document Root, it will output the config to the browser to the user can manually upload it.

The Apache Documentation will merely tell you to make the server installation root-owned. The HTTP Server Documentation does not cover third party applications like WordPress or Joomla!, so it will not discuss their need to have some directories writable. I hope the above makes the picture a little more complete.

Be Sociable, Share!

8 thoughts on “File System Permissions for Apache

  1. By webserver user you mean httpd or the user in /etc/passwd which is apache or www-data or nobody in some cases

  2. @James: I mean the user as which the httpd program runs. This is the value of the User parameter in the active configuration file. Yes, www, apache and nobody are frequently observed values.

  3. Amiable post and this post helped me alot in my college assignement. Thanks you seeking your information.

  4. A person often generate one of the most exciting articles or blog posts. Therefore you generally manage to have bad/boring issues as well as change these individuals in exciting/interesting elements. Im your reader for lifetime!

  5. I am genuinely not too familiar with this topic but I do like to check out blogs for layout concepts and exciting topics. You in fact described a that I typically do not care substantially about and made it tremendously fascinating. This can be a wonderful weblog that I will be aware of. review about advice on site

  6. Thanks Sander – I found this while trying to sort out the issue of writeable directories for Joomla users, and how to set the file permissions to handle this. I had specifically asked this question on the Joomla security forums before finding your blog. Would you mind having a look at this thread and telling me what you think (http://forum.joomla.org/viewtopic.php?f=621&t=655214)? It’s still live; you’ll need a login to respond, or I could post any comments you have if you’d prefer. Many thanks.

Comments are closed.