0

I know I am not the first to ask about it, but it's still not clear to me. I mean, on this post we can read that

777 is a bad permission in general and I'll show you why.

Despite how it may look in a Casino or Las Vegas, 777 doesn't mean jackpot for you. Rather, jackpot for anyone who wishes to modify your files. 777 (and its ugly cousin 666) allow Read and Write permissions (and in the case of 777, Execute) to other. You can learn more about how file permissions work, but in short there are three groups of permissions: owner, group, and other. By setting the permission to 6 or 7 (rw- or rwx) for other you give any user the ability to edit and manipulate those files and folders. Typically, as you can imagine, this is bad for security. (...)

But in the example we can see that the other user is still on the same PC. What is the danger over the NET? Can anyone access or modify your data files remotely? (In my case I'm talking about a STATIC website.)

  • Intrusions from across the network do occasionally happen. Why make it easy for intruder? – user535733 May 23 at 21:51
  • True! And I understand it and won't set those permissions. It was just the curiosity to know if it is really possible to access remotely to the file system and edit it. – Edoardo Benedetti May 23 at 22:06
0

If any program on your computer that connects to the outside world has any kind of vulnerability, an intruder could hijack that program and do anything it's allowed to do. For instance, even if you're running a static website, there could be vulnerabilities in apache or nginx or whatever you're using that allow attackers to send a carefully-crafted HTTP request that overflows a buffer or something and replaces the code that program is running with their own code.

If the account the web server runs as has write permission /var/www, an attacker could then turn around and silently insert malware into your webpages.

And when exploits of this kind are found in major web servers, you can count on the fact that people will be running scripts the next day automatically logging into every server they can find and trying to apply these exploits.

If you're facing the public internet and there's a link to your site anywhere, take a look at your httpaccess logs and you'll see all sorts of really stupid automated attacks on your server, like people looking for an installed copy of phpmyadmin and running through hundreds of common passwords.

On the other hand, if the web server runs under an account that can't write to any critical locations on your computer, the risks are greatly diminished.

  • Thank you so much for the answer! Very useful – Edoardo Benedetti May 23 at 23:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.