When my CentOS 7 Apache web server was compromised recently, which hosts multiple sites, a script was uploaded to one of the sites and then used to add files to any other sites on the server that had writable directories. So, say the websites are stored in:
That directory is owned by root and has 755 permissions:
My question is, how can I configure the permissions, or otherwise configure the web server, so that scripts executed on a site cannot see a directory listing for
All sites are using the
apache user and group.