Permissions Advanced

permissions_advanced.txt

Scanning your server for 777 files and directories

Why are 777 files and directories dangerous:

    A directory or file that is set to 777 is open to the world (in some cases) for writing. So if you are a hacker who knows what they are doing, they can exploit a 777 directory, insert code and even files into your server and then use that file or code to affect more files on your server.

    A 777 directory should be used sparingly and sometimes not at all. It is most often used when there are IMAGES that need to be uploaded or any file types that can not be executed. Or in cases where directories are totally secure ahead of time through programming.

    What about php and html files:

    Any executable script (php and html files included) should NEVER, ever be set to 777. This allows hackers to access them, change their lines of code in specific cases, and destroy your server. So any script or code that is set to permission 777 is dangerous. And any directory set to 777 that has such files in it is dangerous.

    Scanning for such files and directories easily

    The find command can be used to scan for files and directories set to 777. This can be done if you have shell or SSH access to your account or server.

    find . -perm 777
    will return all directories that are set to 777. It runs recursively from your current directory, so if you have a lot of files, it may take the server a while.

    find . -perm 777 -name "*.*"
    will return all files that are set to 777.

    find . -perm 777 -name "*.php"
    will return all files that are set to 777 and are php files.

    fine . -perm 777 > temp.txt
    if you have a lot of results, you may want to send the results to a text file rather than see them on the screen. the > command (which is called a pipe because it pipes results to something else) will send results to a file, in this case temp.txt.

    Scanning files for specific code:

    You may also need to scan files for specific code if you think they are infected, this can be done recursively from any position with this command, which will return files names containing the string of code to the screen:
    grep -r -l 'string' *
    string: is the code or phrase you are searching for
    -r says it is recursive
    -l tells it to print out file names

    Changing permissions recursively:

    Once you find bad files, you may want to change a bunch of permissions recursively, else you would have to do them one by one. You can resursively scan and change files throughout the file structure in one commend:
    find . -name '*.php' -exec chmod 755 {} \;
    changes all php files recursively to permisson 755