To allow one-click updates on my site, I need to make the Craft 'app' folder writeable by the web server. Doesn't this present a security concern...to allow the actual php files of the application to be writeable by the web server?
Doesn't this present a security concern
Not in-and-of itself, but if a malicious user finds an exploit through another means, it does make it easier for them to drop their payload on the file system.
You can, of course, not make the
craft/app folder writeable by Apache/PHP and just do manual updates. Or better yet, do the auto-updates on development or staging boxes (so you can properly test) and deploy to production where auto-updates are disabled.
Security is not off or on, it's layers of an onion. Anything you do has to factor into the bigger picture.
My layers include:
- What user does the web server run as? What user is your content? Your web server should never be the same as the user who owns the files, typically www-data, www, apache, etc. Also, don't run apache as the user nobody.
- Are you using PHP-FPM, su-PHP, fastcgi, or Apache w/ mod_PHP baked in? I prefer fpm since you can run every website as a separate pool and separate PHP ini / open_basedir configs, increasing security. If a site gets hacked, only that pool is affected.
- What are the permissions of the folders/files? Shouldn't ever be 777, ideally 750 for directories and 640 for files. The web server should be added to the user's group and given read permissions (so it can only access static files).
- Who else has access to the server? Deploy users via SSH, (s)FTP, MySQL replication users, etc. Limit access to need-to-know.
Just to play devil's advocate, if you do disable the one-click updates in production, that also makes it harder to simply update, which could be worse than not updating at all. I've seen well-meaning WP Devs tend to fall into this trap, keeping their client's sites in a sort-of cryogenic state. While Craft is not as widely used, the same security precautions apply.
I'm reminded of Brad's post about security here:
Perhaps the biggest thing Craft has going for it, in the event a security related bug is that we can get the fix deployed quickly to our users with Craft's one-click auto-updating. In addition to that, we can mark a release as "critical", which gets special attention in the control panel.
Craft probably needs to eventually write files to the server anyway, including cache files, and assets, so unless you're shutting off access there as well, I'd wager it's the same risk—maybe even more so—because asset files/uploads tend to be in the web root unless you do some file aliasing.
And without question, if you're not backing up your database and filesystem regularly, you're asking for trouble. Let's assume you are hacked. If you don't have good back-ups, whether auto-update is on or off is not going to help you.