File permissions and security

[davert]

I really like the program so far, but I'm concerned about the security. It seems that to use the program at all, I need to make all my files world-writeable. That has obvious problems especially since I'm using php files... though I guess I can switch to SSI. Is there an alternative to this?

I guess one workaround would be putting all the snippets into a separate folder hierarchy...and marking them as includes?

[admin]

Yes, the alternative is to use a high quality web hosting provider that does not require world-writable file permissions for PHP software (snippetmaster) to write to files on your website. 

Basically, snippetmaster doesn't dictate what permissions are needed -- your web hosting provider does.  If they have properly configured their server for high security.. then you shouldn't require 777 or world-writable permissions.

If you'd like a recommendation for a good quality web host which does not require world-writable permission.. let me know. 

[davert]

We're using a virtual private host, running WHM/Cpanel, so we can change any settings needed. Obviously I haven't properly configured the server... are there any tips I can use?

I might just be used to bad software - I haven't tried using 765 yet.

[davert]

d'oh!

Setting the folder to 755 and the file to 765 works!!!

My bad!
 
Well, at least the next person who was too shy to ask might learn from this. Sorry!

[admin]

No worries.   If anyone is worried about security or has any questions about Snippetmaster and security.. they are welcome to ask!

[davert]

I would just like to add that chgroup is important in this. When I added suhosin and suexec, I had to change the group to match that of Apache. Under an older configuration the group had to be the same as the user. Sometimes experimentation is your friend. (I figure sooner or later someone else will have the same issues so I hope you don't mind my adding to the topic.)