Apache permissions on local network [closed]

Question

I'm playing around with some automation for my home and have setup Apache and MySQL on my Pi along with a basic web page to control some pins on the Pi.

I am wanting to set permissions on the whole /var/www/ folder to 0777 using:

sudo chmod 0777 -R /var/www/

What are the security implications of doing this if I am only to use it on the local network via Wi-Fi? I assume there are no implications but want to be certain.

I am simply going to a web browser and viewing my web page at 192.168.1.xxx

Answer 1

What are the security implications of doing this

In terms of someone breaking in through the server itself, this is more a matter of what software it is running. However, you may want to restrict execute permission on most of it.

Note though that directories must be executable by whoever needs to read them (as in the directory node itself, not the contents). As far as I recall Apache needs further configuration to permit it to execute anything, and so it should be simple enough for you to restrict what executables are available in that tree.

Simply setting the execute bit on everything in that tree via chmod -R is a bit silly, presuming most of it can't be executed anyway. If someone has read-write permission on a file, they could replace, e.g., innocent.txt with something, then set execute on it. If everything is already set that way, you will never notice.

Of course, for someone to do anything within your LAN they must first break into it. Automated things that may do this are probably not looking for a local Apache server.

Answer 2

What are the security implications of doing this

From a architectural perspective, your overall security design should rely on component paranoia. Disasters typically arise out of multiple failures, and a lax design on any component can precipitate a larger failure in the context of other components failing. With this in mind, the phrase this if I am only to use it on the local network is a teeny yellow flag. Remember the space shuttle O-ring?

The same paranoia should apply to /var/www. From a security perspective it's better to have the default be read-only. With this default, it is common to make separate directories for:

• static web content that can't be changed by any web user
• uploaded private content this is stuff that can be uploaded but not readable by the public web users
• uploaded consumed content since the web server will be acting on the uploaded content, it should be regarded as potentially malicious
• uploaded shared content this is dangerous because users can upload viruses that hurt other users.
• executable web content this should be very carefully guarded and made as small as possible
• etc.

You will notice that the file permissions on the individual directories may be the same and even writable, but they should STILL be separated architecturally by security implications. This will let your Apache web server direct traffic according to security considerations.

Lastly, Unix permissions are split into owner/group/public. The web server itself is the user updating those www directories, therefore they do not really need to be public.

Security is always the enemy of productivity. Take the above into consideration when you decide what works for you. In the Raspberry Pi world we often run with scissors, since the consequences are usually limited, but a little paranoia can help.

Answer 3

Just provide ro-access to user/group www-data:www-data. That should be enough to allow apache to read the files that make up your application. If you are doing stuff, say, with PHP, and you are saving files and stuff then provide rw access to where you are writing to www-data:www-data and you should be fine.