Why shouldn't I set 777 permission to /var/www?

Question

I know I am not the first to ask about it, but it's still not clear to me. I mean, on this post we can read that

777 is a bad permission in general and I'll show you why.

Despite how it may look in a Casino or Las Vegas, 777 doesn't mean jackpot for you. Rather, jackpot for anyone who wishes to modify your files. 777 (and its ugly cousin 666) allow Read and Write permissions (and in the case of 777, Execute) to other. You can learn more about how file permissions work, but in short there are three groups of permissions: owner, group, and other. By setting the permission to 6 or 7 (rw- or rwx) for other you give any user the ability to edit and manipulate those files and folders. Typically, as you can imagine, this is bad for security. (...)

But in the example we can see that the other user is still on the same PC. What is the danger over the NET? Can anyone access or modify your data files remotely? (In my case I'm talking about a STATIC website.)

Answer 1

If any program on your computer that connects to the outside world has any kind of vulnerability, an intruder could hijack that program and do anything it's allowed to do. For instance, even if you're running a static website, there could be vulnerabilities in apache or nginx or whatever you're using that allow attackers to send a carefully-crafted HTTP request that overflows a buffer or something and replaces the code that program is running with their own code.

If the account the web server runs as has write permission /var/www, an attacker could then turn around and silently insert malware into your webpages.

And when exploits of this kind are found in major web servers, you can count on the fact that people will be running scripts the next day automatically logging into every server they can find and trying to apply these exploits.

If you're facing the public internet and there's a link to your site anywhere, take a look at your httpaccess logs and you'll see all sorts of really stupid automated attacks on your server, like people looking for an installed copy of phpmyadmin and running through hundreds of common passwords.

On the other hand, if the web server runs under an account that can't write to any critical locations on your computer, the risks are greatly diminished.