0

Accrding to drupal docs:

The following is an example file listing of a safe configuration showing two files in a site where uploaded files are stored in the "files" directory. In order to see the file permissions set for your setup, go to the command line and type: ls -al.

drwxrwx---  7 www-data    greg-group  4096 2008-01-18 11:02 files/
drwxr-x--- 32 greg-user   www-data    4096 2008-01-18 11:48 modules/
-rw-r-----  1 greg-user   www-data     873 2007-11-13 15:35 index.php

After running the shell given in the doc page,

#!/bin/bash
if [ $(id -u) != 0 ]; then
        printf "This script must be run as root.\n"
        exit 1
fi
drupal_path=${1%/}
drupal_user=${2}
httpd_group="${3:-www-data}"
# Help menu
print_help() {
cat <<-HELP
This script is used to fix permissions of a Drupal installation
you need to provide the following arguments:
1) Path to your Drupal installation.
2) Username of the user that you want to give files/directories ownership.
3) HTTPD group name (defaults to www-data for Apache).
Usage: (sudo) bash ${0##*/} --drupal_path=PATH --drupal_user=USER --httpd_group=GROUP
Example: (sudo) bash ${0##*/} --drupal_path=/usr/local/apache2/htdocs --drupal_user=john --httpd_group=www-data
HELP
exit 0
}
# Parse Command Line Arguments
while [ $# -gt 0 ]; do
        case "$1" in
                --drupal_path=*)
            drupal_path="${1#*=}"
            ;;
        --drupal_user=*)
            drupal_user="${1#*=}"
            ;;
        --httpd_group=*)
            httpd_group="${1#*=}"
            ;;
        --help) print_help;;
        *)
            printf "Invalid argument, run --help for valid arguments.\n";
            exit 1
    esac
    shift
done
if [ -z "${drupal_path}" ] || [ ! -d "${drupal_path}/sites" ] || [ ! -f "${drupal_path}/core/modules/system/system.module" ] && [ ! -f "${drupal_path}/modules/system/system.module" ]; then
    printf "Please provide a valid Drupal path.\n"
    print_help
    exit 1
fi
if [ -z "${drupal_user}" ] || [ $(id -un ${drupal_user} 2> /dev/null) != "${drupal_user}" ]; then
    printf "Please provide a valid user.\n"
    print_help
    exit 1
fi
cd $drupal_path
printf "Changing ownership of all contents of "${drupal_path}":\n user => "${drupal_user}" \t group => "${httpd_group}"\n"
chown -R ${drupal_user}:${httpd_group} .
printf "Changing permissions of all directories inside "${drupal_path}" to "rwxr-x---"...\n"
find . -type d -exec chmod u=rwx,g=rx,o= '{}' \;
printf "Changing permissions of all files inside "${drupal_path}" to "rw-r-----"...\n"
find . -type f -exec chmod u=rw,g=r,o= '{}' \;
printf "Changing permissions of "files" directories in "${drupal_path}/sites" to "rwxrwx---"...\n"
cd sites
find . -type d -name files -exec chmod ug=rwx,o= '{}' \;
printf "Changing permissions of all files inside all "files" directories in "${drupal_path}/sites" to "rw-rw----"...\n"
printf "Changing permissions of all directories inside all "files" directories in "${drupal_path}/sites" to "rwxrwx---"...\n"
for x in ./*/files; do
    find ${x} -type d -exec chmod ug=rwx,o= '{}' \;
    find ${x} -type f -exec chmod ug=rw,o= '{}' \;
done
echo "Done settings proper permissions on files and directories"

bash fix-permissions.sh --drupal_path=your/drupal/path --drupal_user=greg

After running the above script, the Security review module still warns me that:

Some files and directories in your install are writable by the server.

Ironically the doc page also links to the security review module for double check:

As a quick test to confirm whether your site is secure or not you can run the Security Review module.

Does this mean that there is something wrong in the script? or in the security review module alert if false? Or simply there is no consensus in Drupal community about the files permission? Too bad, if it is so.

This can be a huge security hole when the permission to the uploaded files are not set properly. So I am wondering what is the proper permissions for files for a fairly paranoid setup?

Also, should greg be member of www-data group?

1

Your example permissions (as listed near the befinning of your question) are fine. The Drupal docs page you link to is correct and reflects IMHO the consensus of the communty. The script you're using reflects this consensus.

I'd say that this is a false postive from Security Review. It also appears that this bug has been reported to the module's issue queue.

As stated on the Drupal docs page: All you need to know to review this yourself is that it is only files/ and the directories and files below it that shall be writeable by the server. So if the character wshow up in anything owned by www-data or the www-data group on your site (letter 3 in the permission string is the setting for the www-data user, and letter 6 is the the setting for the www-data group) - then the site is not secure.

While it may appear insecure that files/, its subdirectories and uploaded files are writeable by the server, this is not the case. Drupal itself and the way Drupal sets up the web server (by means of .htaccess, etc. ) prevents code (shell scripts, php, etc.) that an attacker may upload (disguising it as an JPEG or other "allowed" upload file types) from being excuted. Drupal has built-in management of uploaded files that ensures, for instance, that file attachements is deleted when the node they're attached to is deleted. For this to work, the upload directory (e.g. files/) and the files it contain must be writeable by the server.

Also: greg should not be a member of the www-data group.

  • Well the security review module does not make distinction between files in 'files' folder and elsewhere, and IMHO for good reason. You don't want attackers to write shell commands anywhere. So, I tried to make ALL the files g-w. to avoid the alarm. However afterwards newly uploaded photos are still -rw-rw-r-- . Any tips to avoid this? – alfish Jan 21 '14 at 7:00
  • No. You don't want to change this, because then uploaded photos will not be deleted when the node they're attached to is deleted, and Drupal's "managed files" feature will stop working. Drupal itself and the way Drupal sets up the web server (by means of .htaccess, etc. ) prevents code (shell scripts, php, etc.) placed below files/ from being excuted. – Free Radical Jan 21 '14 at 7:09
  • I use php5-fpm instead of apache and currently struggling with some weird session hijackings. So rather prefer to close vulnerability door that being worried about deleting images at node delete. – alfish Jan 21 '14 at 7:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.