Re: File Permissions?
| From: | Adam Jon Richardson | Date: | Wed, 16 Aug 2017 16:10:09 +0000 |
| Subject: | Re: File Permissions? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-326149@lists.php.net to get a copy of this message | ||
On Wed, Aug 16, 2017 at 12:02 PM, Tedd Sperling <tedd@sperling.com> wrote:
>
> We had an incident happen at the college where I teach — the IT guy said:
>
> > After further inquiry, it appears a bad guy used a php vulnerability
> injection over http to enter into a folder on CITW. This was made
> possible because the permissions were misconfigured (execute was set to 755
> instead of normal 644).
>
>
> My understanding of permissions is that 755 is normally thought of as
> secure — is that not true?
>
755 is typical for directories, but 644 for files.
https://premium.wpmudev.org/blog/understanding-file-permissions/
That said, I often even reduce the permissions beyond 644 in production
environments.
Adam