When my CentOS 7 Apache web server was compromised recently, which hosts multiple sites, a script was uploaded to one of the sites and then used to add files to any other sites on the server that had writable directories. So, say the websites are stored in:


That directory is owned by root and has 755 permissions:


My question is, how can I configure the permissions, or otherwise configure the web server, so that scripts executed on a site cannot see a directory listing for /home/sites?

All sites are using the apache user and group.

  • Are you looking for a chroot jail?
    – Arminius
    Feb 20, 2017 at 19:04
  • Thanks, that looks promising. Will have a good read through it.
    – user112461
    Feb 20, 2017 at 19:05
  • No, that's not really what I'm looking for. It would prevent access to the rest of the system, but actually all the site folders would still be in the jail together so it wouldn't solve this isse.
    – user112461
    Feb 20, 2017 at 19:12
  • Do all sites have to have the same user and group? Otherwise you could use suPHP which runs scripts with their respective owner permissions.
    – Arminius
    Feb 20, 2017 at 19:32
  • No, they don't have to. But it wouldn't help. Any user could still list the directory under the above setup. It's the world write permissions that are the issue. I think I solved it and have added an answer below. I will be implementing it later today, so will confirm after that.
    – user112461
    Feb 20, 2017 at 19:35

1 Answer 1


It looks like all I need to do to acheive this is set the permissions to 711 on /home/sites:


Then a directory listing cannot be generated but files within it can still be accessed.

  • Seems like you are looking to prevent writable directories than directory listings ?
    – Lester T.
    Feb 21, 2017 at 1:00
  • No it's directory listings I'm looking to prevent, hence the missing r bit. To prevent writing I would only need to avoid the w. Don't see how it seems that way when the question clearly states what I'm trying to do?
    – user112461
    Feb 21, 2017 at 3:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy