Host is stepping up security measures - auto changes chmod 644 to 600

[frank18]

Good day all

I just had this email in from my host (I am running a reseller acount...):

PHP permissions
==========
On all our Shared/Reseller hosting Services we are running php as suPHP. suPHP provides an additional layer of protection. It causes php scripts to run under the account username instead of the user 'nobody' which is the user that apache/php would normally run under on a server that is not running suPHP. This feature allows us to easily track any potential security breaches that come in via insecure php script(s) that a hosting account is running.

suPHP also does away with the requirement for using 777 permissions on directories/files that need write permissions. In fact if a directory and/or file has the permission set to (CHMOD) 777 and it is accessible via a browser, then an internal server error 500 will be generated. The highest level of permissions that a user can use on a suPHP enabled server is 755. This permission setting is sufficient enough for any directories/files that needs to be written to.

Following on from having suPHP enabled on all our servers, we are planning to implement another PHP security enhancement in the coming weeks. At present, files on a shared/reseller server which are set to 644 permissions are readable by any user in the server since users are not jailed or locked down. This results in a security risk as configuration files containing database usernames & passwords may be exposed to other users on the same shared/reseller node. So, we recommend to avoid giving more than 600 permission to php files containing critical usernames & passwords or other configuration details.

If a hosting account on a particular shared/reseller node does become compromised, that account or user could inturn be used to read files that have the permissions set to 644. So to reduce the impact or risk of such an event occurring we are planning to enforce 600 permissions for php files on all our AU shared/reseller Servers. This means that each shared/reseller server will check permissions of php files every 30 minutes and server will set permission as 600 if it is not set as 600 or 400 already.

We however understand that some php web applications out there will just not run without having some permissions set to 644, if this is the case then you may exclude a particular domain from the automatic permissions check. If you wish to exclude your website from automatic permission changes, please create a file named "nochmodme" or "nochmodme.txt" in your home folder.

Please contact our technical support, if you need any assistance/clarification regarding this. However if you do exclude a particular site from this check, you could be increasing your risk of having that site compromised. If a php web application does require 644 permissions then you should contact the web application developer / provider to see if there is an alternate solution or fix.

The aim here is to create a secure environment for all Shared/Reseller hosting customers to operate their websites and to ensure one compromised site doesn't affect others. We trialled this permissions check on two of our Shared/Reseller nodes already with great success, and will be rolling this security change out over the next week. We recommend all Shared/Reseller hosting customers confirm their permissions and confirm what site's they might need to exclude.

FAQs
===
1. Will my website stop working with new permissions ?
Answer: Most probably no. Only web application we found issue so far is "Interspire Shopping Cart". So, if you are using interspire, please create a file named "nochmodme" or "nochmodme.txt" in your home folder.

My questions:

1. Will this measure affect the functionality of my ZC installs?

2. what is your opinion about the planned changes?



Thanks in advance

Frank

[RodG]

My questions:

1. Will this measure affect the functionality of my ZC installs?

I don't know the zen-cart code well enough to comment with 100% certainty, and its getting a bit late in the evening for me to make the same changes on my test machine to see if anything breaks. (Well, can you think of a better way to test?)

2. what is your opinion about the planned changes?

As with almost any security measure there is always a trade-off. Increasing security is always a good idea, but eventually it gets to the stage where things are so secure that they become unusable.

Zen-cart (and other store developers) could already force these permissions (or similar), as well as forcing other security enhancements beyond those proposed by your host, but generally speaking, they have opted to use lesser restrictions in order to minimise problems, especially for new users.

I've seen comment that some people think the zencart 1.5 beta is already too restrictive, and this could actually be aggravated by the forced security imposed by your host. Sadly this is a cost that we have to pay because far too many people are running websites dealing personal/sensitive data and the majority of those people either don't know, or simply don't care about site security (until after they've been hacked).

Anyway, to answer the question... I think it is a great idea.. Yes it will make things a little more difficult for a lot of people, but those people are the ones that *should* have the knowledge to not be stumped by the changes in the first place.

I'd be tempted to teach you how to interpret what those permission numbers actually mean (which will help when trying to solve permission problems), but the last time I tried, about a month ago, I was not so politely informed I had it all wrong (which is rather embarrassing really because I train/assess IT students this kind of stuff).

Oh well...

Cheers
Rod

[frank18]

Thanks Rod

Re-checked the Wiki and FAQ's, but no mention about chmod 600 for files being workable or not.

I might try one of my local installs (ZC 1.3.9h on Apache 2.2 running on Ubuntu 11.04 box) and see what happens

It would save me some time if one of the devs could come up with an answer though.

Frank

[DrByte]

For Zen Cart to work, it relies on the PHP engine to run.
For the PHP engine to read the .php script files, they need to be "readable" by whatever user/process is running the PHP engine on the server.
In modern-day server configurations, the PHP process is often running as the "user", which is the first of the 3 linux permissions digits. So, "400" (where "4" means "read" and since it's in the first position, refers to the "user" permission) is the lowest acceptable level. Some servers still use the "group" (2nd position) or "world" (3rd position) setting to run PHP, which case 440 or 444 would be required as the minimum level.
But, the details of that are all advanced stuff, and if you really want to study it, there's an FAQ article on it, as well as hundreds of other online articles available by using your favorite search engine.

As far as Zen Cart goes, PHP needs to be able to read the files.
And, for certain operations, it needs to be able to write to certain files and folders. Those are outlined in the various FAQs on the topic, findable by searching for "file permissions" in the FAQs library at https://tutorials.zen-cart.com.

A handful of files/folders need to be writable for Zen Cart to be able to allow uploads of images etc, or to write out certain logs or cache data. So, where Zen Cart instructions talk about making a file or folder writable, you need to set it to whatever permission level equates to writable as determined by your hosting company's server configuration.
Same with read-only.
Again, the correct setting is based on the server's configuration. If keeping those files/folders writable requires special configuration to be done by you to retain the ability for PHP scripts to write to them, then follow instructions provided by your hosting company to accomplish those results.

Work with your hosting company to sort out whatever you need to do special to work with your server.

[frank18]

Thanks Dr Byte, much appreciated.

I will point my hosting people to this thread and in particular to your post. They are a very good hosting company, so cooperation etc is not a problem at all.

If anything of interest emerges then I will post their replies here as I am suspecting that other hosts may follow suit.

Thanks again / Frank

[DrByte]

Ref:
https://www.zen-cart.com/tutorials/index.php?article=9
https://www.zen-cart.com/tutorials/index.php?article=73 (see especially the "folder purposes" section near the end of this article)

[frank18]

Ref:
https://www.zen-cart.com/tutorials/index.php?article=9
https://www.zen-cart.com/tutorials/index.php?article=73 (see especially the "folder purposes" section near the end of this article)

Thanks again / F

[Website Rob]

Permissions of 600 are workable for Zen Cart but could become a PITA for you. You will not be able to edit certain files from within your Admin; such as Admin > Tools > Define Pages Editor.

If you are OK with with making any file changes on your computer then uploading the changed file, then not a problem. Otherwise, have your site excluded as mentioned by your Hoster.

Sometimes security can be taken too far at certain levels. As mentioned earlier in this thread, good Firewall Rules will prevent all kinds of bad things from happening without Clients having to worry about working around lockdown.

[frank18]

Permissions of 600 are workable for Zen Cart but could become a PITA for you. You will not be able to edit certain files from within your Admin; such as Admin > Tools > Define Pages Editor.

If you are OK with with making any file changes on your computer then uploading the changed file, then not a problem. Otherwise, have your site excluded as mentioned by your Hoster.

Sometimes security can be taken too far at certain levels. As mentioned earlier in this thread, good Firewall Rules will prevent all kinds of bad things from happening without Clients having to worry about working around lockdown.

Yes, not being able to edit files from admin certainly can/will be a PITA , especially if you need to make changes from a machine other than your own.

Thanks all, I think I am going to exclude my ZC installs ....

Frank

[RodG]

As mentioned earlier in this thread, good Firewall Rules will prevent all kinds of bad things from happening without Clients having to worry about working around lockdown.

Firstly, there has been no mention of firewalls in this thread.

Secondly, no firewall rule is ever going to "prevent all kinds of bad things from happening without Clients having to worry about working around lockdown".

And I do mean *ever*.

What's happened to you lately Rob? Less than a month ago you showed an embarrassing lack of knowledge in regards to file permissions, and now you are making wild statements that show a clear lack of understanding in regards to firewalls.

I'd fully expect your broad response(s) from a typical end user, but not from someone that uses a pseudonym of "Website Rob". You *SHOULD* be more knowledgeable.

Sadly, I already know from previous experience what your response to this is going to be, and even sadder, you *think* you already know this stuff, and as such you are not going to make any further effort to educate yourself.

I apologized to you (in private) for embarrassing you in our previous discussion, and you even managed to take that the wrong way and you assume I was apologizing because *I* made a mistake.

Please Rob. do me a favour and stop giving misinformation to end users. You (and others like you) make my job REALLY HARD.

File permissions have specific requirements for specific tasks. They define who has what access to any given file.

Firewalls have a completely different objective not related to file permissions in any way shape or form.

We start teaching about File permissions in Cert II Information technology. http://training.gov.au/Training/Details/ICA20105
We don't touch on firewalls until Cert III (other than to advice students still reliant on Windows how to open certain ports) http://training.gov.au/Training/Details/ICA20105.

Someone with your moniker should have at least achieved ICA40305 Certificate IV in Information Technology (Websites). Alas, based on many of your comments over the past few months I would have serious doubts that you'd get past Cert III. I know that as an assessor I would be unable give you RPL (Recognition for Prior Learning) for several of the required units of competency.

Do you know how hard it is to 'un teach' something like "good Firewall Rules will prevent all kinds of bad things from happening without Clients having to worry about working around lockdown"

How many people reading this are going to say to themselves
1. I have no control over the firewall used by my webhost, but I assume they know what they are doing, so I won't need to lock down my files' ?

or
2. "I have a firewall on my home router, so web files should be safe".

Both statements being completely false and as such, they pose a security risk by way of misleading information.

OR... lets go the other way.. If you lock down the file permissions why do you need a firewall? (seriously)

I don't have a firewall running on any of my home computers and they've never been hacked (online 24/7 since 1995).
How can this be?

Look, I'm really NOT trying to cause you embarrassment, and I freely acknowledge end users don't need to know the 'techy stuff', but you are presenting yourself as a knowledgeable Web person, and your statements may impress the end users, but it is literally causing many of us to pull our hair out and/or hang our heads and cringe in shame. Sorry, but someone had to say it, so why not me :)

Regards
Rod