We have a Web Server that mount Centos. Onto that WS there is an Apache (version 2.2.3) and some sites.

You can log on only if you have a certificate (for root user) or via ftp (a restricted partition of data for upload contents, but this is not the point) or through apache that have some permission for write onto certains directory.

In recent past we had some trouble with that policy since who can "hack" apache, could delete files onto apache's writable directories. But we didn't get scared since today.

Today we notice that a log file and a log directory, particularly the httpd log's directory and log's files, have undergone a change of permissions (in detail, someone removed the +x perm. to other users. Permissions were 755). Since the owner is root and the group is root, could someone tell me if there is an alternative explaination to "someone stole your certificate" ?

Moreover I know that keep software up to date is the best method for prevent well-known flaws, but in that case I can't image someone that via Apache could do something like that.

  • 1
    Are you running any script based sites, such as php? And if so, do those scripts run as the webserver account (ie, you are not using suphp or similar?)
    – Paul
    May 15, 2012 at 9:42
  • @Paul yes, we have php onto our sites and it runs under apache credential.
    – DonCallisto
    May 15, 2012 at 9:51

1 Answer 1


Are you saying that your permissions were 755 but are now 754 or 644? Looking at my Apache logs (Ubuntu, don't have CentOS handy), they should be 644. Was Apache restarted?

Regarding possible methods of attack (hypothetically speaking of course) -

Presuming that someone did not steal or successfully fake the certification authentication, a possible theory is that someone stole an FTP login (entirely plausible, through social engineering or sniffing the cleartext protocol somewhere along the FTP connection), and then performed privilege escalation (through a vulnerability in the FTP service, Apache (unlikely: not aware of any at the moment), some other software installed on the system, via the Linux kernel (they do exist but I presume you're well patched on that front, unless someone threw a 0-day your way, again unlikely but possible if you've data that someone really wants) or via your web application depending on how well its coded). PHP apps are renowned for being insecurely developed and are frequently exploitable.

I'd recommend removing FTP access and replacing it with SFTP (using key authentication).

  • Thank you for your answer but I know that our FTP access are "isolated". That means that if you log in into a certain directory, you can't unfold to the root. Am I missing something? How it is possible to do that ??
    – DonCallisto
    May 15, 2012 at 10:09
  • 2
    Typically this escalation happens due to mis-configuration or a software bug. Google "ftp privilege escalation daterange:2455331-2456062" and you'll see a bunch of information.
    – Mark Hillick
    May 15, 2012 at 10:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .