1

A few days ago I installed a new linux os. Today i realize /root has o+r (755) so EVERYONE is able to see my root sql password in /root/.my.cnf. I freaked out and simply changed /root to 750.

My /var/www folder is 2755 but all the folders in it are 2750 (so certain users can browse to the folder without being blind). What software, file permissions and other DEFAULT configuration should I change?

Improve this question
12
  • 6
    Please specify the distro you installed. None of the ones I've used set /root to world readable. Commented Feb 28, 2011 at 5:58
  • 2
    @Keith: Really? Ubuntu 8.04 and Debian 6 both have root as readable to others. Commented Feb 28, 2011 at 8:38
  • 1
    Well, I don't use those. ;-) Commented Feb 28, 2011 at 10:02
  • 2
    Always set the permission on files with passwords to 600 or 400. The loosest permission I would allow is 640 or 440 if users in a specific group need access. I have an ssl-certs group where this would apply. Commented Feb 28, 2011 at 21:58
  • 2
    @Tshepang: /root has always been 755 on Debian and Ubuntu, as far as I remember. My unreliable memory goes back to potato, and I can verify this for machines where the first install was etch, lenny, warty, hardy or lucid. Commented Feb 28, 2011 at 22:38

1 Answer 1

Reset to default
0

perhaps you should do a scan of your system with a tool like tiger. Tiger will pick up lots of things like this, and is a great way to get lots of advice and suggestions about how to secure your system. Tiger can also be useful as a kind of Intrusion Detection System, too.

Improve this answer
2
  • It didnt show me the 755 problem (i changed it to 755 for my second scan to see if it picks it up. it didnt) but i like tiger anyways so +1 Commented Mar 7, 2011 at 22:46
  • hmm, well then I apologise! it will go crazy if root's ~/.ssh folder is world-readable, for example. If Debian ships with /root as 755, and tiger doesn't warn about it, I would take that as a decent indication that it's not an unreasonable setting to operate with. Commented Mar 8, 2011 at 1:50

You must log in to answer this question.