3
    drwxr-xr-x  8 www-data www-data
    drwxr-xr-x  6 www-data www-data
    -rw-r--r--  1 www-data www-data
    -rw-r--r--  1 www-data www-data
    -rw-r--r--  1 www-data www-data
    drwxr-xr-x  7 www-data www-data
    drwxr-xr-x  7 root     root    

This is on a wordpress install on an AWS linux server and that "root" owned folder is where all my changes go. To write my changes to that directory I had to sudo them in, that left ownership as "root" whereas every other folder is the defacto "www-data" user group.

Is this bad? Why?

  • It's bad. It's well documented. If a script in there has a vulnerability then whatever your hacker wants will run as the file owner, root, allowing them to do anything. – Andy Macaulay-Brook Oct 2 '16 at 20:35
5

I fixed this by running this command:

    cd /var/www/html/
    sudo chown -Rv www-data:www-data *

Changed ownership back to www-data instead of root. This article helped me:

http://johnqunknown.me/fixing-wordpress-a-mini-tutorial/

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.