2

Up until now I've been "protecting" my website's PHP files by making them read-only with chmod.

Is this a useful security tactic? Or is it some "old wive's tale" and I'm wasting my time?

I'm inclined to think that anyone who is in a position to modify my PHP files could also chmod them (thus barely slowing down any would-be attacker). Or they could just create a new file somewhere (like a cache or upload directory). Thoughts?

The downside of implementing this technique is that I have to shell in and make the files writable every time I want to automatically update WordPress (or, really, make any changes to my site). So I update less often than I probably should. So, even if it's marginally useful, is it worth it?

Improve this question
1
  • I don't have enough experience with all the attacks that can happen, but from my understanding, PHP is only accessed by your server at the time the browser asks for information or if you use FTP to upload/download it. If someone has access through FTP, making it read-only won't matter much. Not that I manage any high profile site and receive a bunch of attacks, but I have not had any issues in the past 9-10 years and I never use read-only.
    – BillyNair
    Jul 17, 2012 at 10:42

2 Answers 2

Reset to default
2

If you also make the PHP files owned by some user other than the one that Apache runs as, then yes, you have blocked off one potential attack scenario. If you leave them owned by the Apache user then an attacker with Apache-level privileges (an example of this would be code injection or a remote file inclusion) would be able to chmod the files and edit them anyway.

This doesn't block off any other attack scenarios such as an attacker guessing your SSH password or finding a flaw that gives him root access.

If an attacker managed to get Apache-level privileges to your server but couldn't edit PHP files due to the ownership and permissions, it's likely that they would either do what they can to achieve their goals (say, upload a new script to the uploads directory or plant a .htaccess file somewhere) or use what access they have to escalate their privileges until they can edit the files.

If it's causing you to not update Wordpress as often as you should, then it's probably decreasing overall security. Out of date Wordpress is far worse than writable PHP files owned by the Apache user.

Improve this answer
2
  • To summarise my understanding of what you're saying: the only way to actually get the security advantage I'm expecting is to chown the files (not just chmod). And even then, the advantage is minimal, as an attacker could simply write a new PHP file somewhere. So I think I'll stop bothering with this practice.
    – Andrew Russell
    Jul 18, 2012 at 7:13
  • Even though an attacker might only have read-only access to certain files doesn't make it more secure. By having read rights you can still read files and extract database password etc.
    – user555
    May 3, 2013 at 22:20
2

Linux has the notion of security groups, so you can set a file read-only to one group, but not another. It is going to be easier for an attacker to pretend to be any user, rather than users with more privilege, like root. If they manage to pretend to be a user with lesser privileges then they are not going to be able to chmod the files, whereas if you've left them writable to all users, then they can modify them.

So it's a good thing to do, but certainly not the only thing you can do.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.