1

I have a web application needs write access to certain folders on a LAMP server.

Since suPHP / suEXEC escalate operations to an account you specify, it seems like your server is no more secure because a hacker could still compromise your site (you just get to pick the user).

Is this any more secure than granting www-data write access on those specific files / folders?

Trent Scott
  • 959
  • 1
  • 12
  • 28

1 Answers1

3

Keep in mind, suexec does not eliminate all security problems, and deals only with a very small subset of issues. You mention that a hacker could still compromise your site, but as a different user--which is true. But consider this--on a shared hosting environment, where all the Apache instances are running as www-data, an exploited Apache process now has access to everything www-data has, which likely spans multiple users.

So if you had a user that could ONLY view its own files, had a jailed shell (if the hacker was able to exploit and login as the user), disabled login, etc., then exploiting that user, specifically, would have only a limited effect. The purpose here is not to prevent hackers from getting in, but to limit their damage once they are. Since CGI can be exploited, it still falls on your shoulders to make sure that your scripts are still secured.

Andrew M.
  • 11,182
  • 2
  • 35
  • 29
  • Thanks for your answer. That confirms what I thought. On a private server (only my websites), is there anything wrong with granting www-data access to folders that need it? Seems like suEXEC won't really help when there's only one website and it belongs to me. – Trent Scott Apr 25 '12 at 16:29
  • 1
    There won't be a huge benefit in your case, from the sound of it, no. – Andrew M. Apr 25 '12 at 17:07