I have known people who give ownership to all production scripts to nobody and set them all to 500(-r-x------). That way the scripts in production can ONLY be run and read by the webserver and anyone who sees them through the webserver (all black hatting aside).

From a security standpoint this is a very bad, bad idea. The whole purpose of the 'nobody' account is that it has NO special privileges. Nothing should be owned by it, nothing should be available just to it. If you want something readable or executable to 'nobody', you should do so by making your file/script world-readable and -executable. If you have a problem with that, you should set up your users/groups/ownerships a bit differently (running the web server/whatever as a real user, for example). Any potentially insecure daemon that runs as nobody and is broken into would, in theory, be restricted to the 'nobody' user, which means they shouldn't be able to do anything to any files (though they might be able to fill up, say, /tmp). If you give them ownership of a bunch of files like your web docs/CGI scripts, even with a restrictive set of permissions, they're just one chmod shy of defacing your site and finding ways of elevating their privileges further.

Granted, with a suitably equipped intruder, even with the 'nobody' account they can find ways of getting deeper into your system with any local account, most intruders of this nature can not, and only through script-kiddie-friendly installations such as this do they get to deface web sites without working outside of the user the web server runs as.

In reply to RE: (jptxs) Re: Secure Permissions? by Fastolfe
in thread Secure Permissions? by footpad

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.