Hi!

Section 12.1.12.1 _Are all system users necessary?_[1] lists statically
allocated system users and their intended purpose.

[1] which is in
http://www.debian.org/doc/manuals/securing-debian-howto/ch12.en.html#s12.1

Among the others, the following items for 'www-data' and 'backup' are
included:

| * www-data: Some web servers run as www-data. Web content should not
|   be owned by this user, or a compromised web server would be able to
|   rewrite a web site. Data written out by web servers, including log
|   files, will be owned by www-data.
|
| * backup: So backup/restore responsibilities can be locally delegated
|   to someone without full root permissions.

These two explanations are a bit unclear, at least to me.
I mean: what is the recommended (from a security point of view) setup
for the above mentioned tasks?


More in detail, web servers must obviously be able to read web content
(so that they can serve it); hence it seems that web content should at
least be readable by www-data *group*.  Is that right?
Would it be wise if web content were owned by a regular user (say
user Ronny Regularuser, username 'ronny') who is the webmaster, and
by group 'www-data', and created with umask 0027?
Something like:

$ ls -altrF /var/www/test/
total 16
drwxr-xr-x  4 root  root     4096 2005-11-01 18:47 ../
drwxr-x---  3 ronny www-data 4096 2006-09-09 07:55 old/
drwxr-x---  3 ronny www-data 4096 2006-10-08 10:23 cur/
drwxr-x---  4 ronny www-data 4096 2006-11-01 13:41 ./

What if more than one user needs to be able to create directories
inside /var/www/test/ ?
Should webmaster(s) belong to group 'www-data'?

Could a more detailed explanation of the recommended setup be included
in the section (or placed elsewhere and linked from this item)?


As far as the 'backup' user is concerned, assuming that I want
to perform both system and data backups, how can the 'backup'
user read all the files it needs to backup without having
superuser privileges?
How should things be set up, in order to achieve this goal?

Could a more explicit description of the proposed setup be included
in the section (or put elsewhere and linked from here)?


Thanks for considering.

I don't think it would be wise, if the user 'ronny' was compromised the
website would be defaced. root:www-data with mode 750 seems more plausible to
me.

It really depends on how you publish content to the site. Some people do it
through some intermediate mechanism (such as CVS) some others do it directly
to the site.  The UNIX filesystems permissions allow just so much, if you
have a complex setup you might need to go to extended ACLs.

Yes, webmasters should probably belong to www-data

Will try.

You can have a setuid-root local program that makes backups and can only be
executed by the 'backup' user.

Will try, backups are complex things to do. It is typically best to have a
cron job do the backup or have a backup client (which runs as root or runs
setuid applications) that can be handled locally or remotely.

Regards

Javier

[...]
[...]

But wouldn't it be dangerous, as webmaster operations would require root
privileges?
I mean, the webmaster and the sysadmin could well be two distinct
persons: how can we handle the modification of web content? Has the
webmaster to contact the sysadmin everytime he/she wants to change even
a minor detail?

I would be interested to read an explanation of possible secure setups
for both these situations.

For instance, assuming that I use a revision control system (such as
CVS, or GNU Arch a.k.a. Tla, or Bazaar-NG, or ...), I would want to only
store the source for the web content (that is to say, the preferred form
for making modifications), but publishing both source and compiled forms
(if any). Examples could be PNG images generated from SVG (through
Inkscape), or XHTML pages generated from ReStructured Text (through
Python-DocUtils' rest2html).
Who would have write access to the repository?
How would the web content be updated as the repository changes?
How would the generation of compiled forms be handled?

Otherwise, assuming that I want the webmaster to deploy and change web
content directly, how would the write access be handled?

Hi!

Is there any progress on this bug?

I'm unsure what we should be doing on this bug. I think the current
description of www-data gives the most factual one: it is the one the
webserver will run as, so don't make the content writable by it.

Who else on the system gets write access, seems very environment specific so
hard to put in an understandable text, and may be very different depending on
if files are modified directly by a shell user, there's a vcs that does
automatic updates or there's a cms with a database. Nonetheless, all these
scenarios I can handle as long as I remember the undesirability of write
access for www-data as described above.

Can you make a more concrete proposal of an improvement to the text?


Cheers,
Thijs