nilsteampassnet / teampass_doc

8 stars 31 forks source link

Installation instructions insecure by default #19

Open quixoticgeek opened 3 years ago

quixoticgeek commented 3 years ago

The installation instructions for installing on linux include the following:

sudo chmod 0777 install/ includes/ includes/config/ includes/avatars/ includes/libraries/csrfp/libs/ includes/libraries/csrfp/js/ includes/libraries/csrfp/log/ files/ uploads/

changing permissions to 777 is really REALLY bad practice and should not be recommended without detailed information explaining why this is necessary, as well as a further instruction detailing changing the permissions to something more secure for every day use.

Permissions should depend on ownership, but if the ownership matches the user the webserver runs under (i.e. www-data on debian), then 644 or 755 would be more appropriate permissions.