I'm from a programming background and been thrown into managing a Linux server at work because of an emergency with our reg sys admin. Is it reliable or safe to have our PHP files owned by root yet Apache obviously running on Fedora 8 as apache?
Apache is given rights to read and in minor cases like the uploads directory, write privileges by chmod 777 for that uploads folder.
We are running mod_security but wondered if there was some better practice. I'm alone on this for the next 2-3 weeks while the sys admin is recuperating.
Best Answer
What group owns the PHP files? Your mention of 777 suggests that it's the 'wheel' or 'adm' or some other privileged group, so that the only way Apache can see any file is when that file is world-readable. Or world-writable, in the case of the uploads folder.
That's almost certainly not a good thing -- although the severity would depend on what all you're running on the server (both web-based and otherwise), whether any of the PHP scripts contain plaintext credentials, etc.
If, on the other hand, the files are owned by the gid that Apache runs under, then you're in somewhat better shape. You could in theory do a
chmod -R o-rwxon DocumentRoot to remove all "world" privileges, and everything would most likely be nice and safe and your web pages would still work.But then there's the question of setuid bits. I'm not sure off the top of my head whether a root-owned PHP script with setuid turned on could, in practice, be exploited for malicious purposes, but I wouldn't want one on my web server.
And even if setuid is not a concern, the root-ownership still doesn't smell right to me.