Ok, so the file can be manipulated in any way by any script on the server. But why is this not secure? If you already have a script there, than the person who uploaded it has access to your server anyway... So what's the catch here? |
|||
|
|
One reason is that it's easier to gain user access to a linux server than it is to gain root or the specific user that's allowed to access the script. If you set the permissions so anyone can access/modify/delete all important scripts, then you're removing a layer of security that user based permissions provide. If someone fumbles across a user account then they can take down your server. The best security is built in layers. Maybe your question is based on how FTP accounts work. If you have a full ftp access account to a server, then you can do anything you want to the available files regardless of their permission. That's an insecurity in allowing full FTP access to a server. This isn't limited to linux servers, just using them as an example. |
||||
|
|
