777

[LogicHeLL]

I program a php based website builder for a living, and have recently taken an intrest in hacking and php exploits. Our software requires 777 permissions on a few folders (not the doc. root), and I was wondering if this is a legit security risk. I have tried researching this, but any search containing both 777 and security return results on the obvious dangers of php files with 777 permissions. If someone could shine a little light on this for me, I would be most appreciative.

I have found these forums to be a kick ass resource, so hopefully this post doesn't result in an invitation to the world renowned Fucktard Hall. This may seem like a stupid question to some of you, but I have only been in the online software industry for a few years.

[noid]

Well, the question I would ask is a two parter

1. Which files are mode 777

2. Do they have to be written to by 'other'

Have you tried locking the permissions down and seeing what breaks?

Having a file mode 777 isnt a bad thing, depending on who owns it, what group its in, and what data is contained in it. However if theres no need for group or other to be able to read and write to it, it needs to be fixed.

[Voltage Spike]

Which files are mode 777

He didn't say the files were 777, but that certain directories were (everything is a file, blah, blah). However, the question still stands.

I have a few directories on my system that are 777 (such as /tmp), and I realize that there could be some problems (e.g., a user filling up the disk with bogus information), but there are situations where giving "others" access is much simpler. What kind of risk factor are you willing to accept?

[LogicHeLL]

Well, the question I would ask is a two parter

1. Which files are mode 777

Two Folders inside the docroot. None of the php files have permissions above 755. The problem arises when uploading files through our product when the owner and group are not apache.

2. Do they have to be written to by 'other'

Have you tried locking the permissions down and seeing what breaks?

Having a file mode 777 isnt a bad thing, depending on who owns it, what group its in, and what data is contained in it. However if theres no need for group or other to be able to read and write to it, it needs to be fixed.

The issue here is that our software autoinstalls through Cpanel. Cpanel uses the domain's cpanel username for owner and group when it installs our software. This results in a file upload failure unless the destination folder is 777 . However most of these servers are running phpsuexec, insuring safe permissions on php files.

[TheCotMan]

The issue here is that our software autoinstalls through Cpanel. Cpanel uses the domain's cpanel username for owner and group when it installs our software. This results in a file upload failure unless the destination folder is 777 . However most of these servers are running phpsuexec, insuring safe permissions on php files.

Are these users also in /etc/passwd with UID on the system or are these usernames for file ownership in an application separate from the OS?
If they are part of the OS, and in /etc/passwd, you could add a new system user like "cpanel" and then modify your apache config to run with the GID of "cpanel" as well as the default user (apache? nobody?) then you ater /etc/passwd to place everyone that needs this access into the default group of "cpanel" -- this may allow the dirs to be 775 and still work.
Problems? You would need to look through your system at files used by apache and verify that if they were for the OLD GID, they get moved to the new one and set to be group -w, and for files that have private keys or whatnot, remove group rwx.
Of course a restart of the web service would be needed after all of this for many reasons.