2

When my CentOS 7 Apache web server was compromised recently, which hosts multiple sites, a script was uploaded to one of the sites and then used to add files to any other sites on the server that had writable directories. So, say the websites are stored in:

/home/sites

That directory is owned by root and has 755 permissions:

rwxr-xr-x

My question is, how can I configure the permissions, or otherwise configure the web server, so that scripts executed on a site cannot see a directory listing for /home/sites?

All sites are using the apache user and group.

  • Are you looking for a chroot jail? – Arminius Feb 20 '17 at 19:04
  • Thanks, that looks promising. Will have a good read through it. – Nigel B. Peck Feb 20 '17 at 19:05
  • No, that's not really what I'm looking for. It would prevent access to the rest of the system, but actually all the site folders would still be in the jail together so it wouldn't solve this isse. – Nigel B. Peck Feb 20 '17 at 19:12
  • Do all sites have to have the same user and group? Otherwise you could use suPHP which runs scripts with their respective owner permissions. – Arminius Feb 20 '17 at 19:32
  • No, they don't have to. But it wouldn't help. Any user could still list the directory under the above setup. It's the world write permissions that are the issue. I think I solved it and have added an answer below. I will be implementing it later today, so will confirm after that. – Nigel B. Peck Feb 20 '17 at 19:35
1

It looks like all I need to do to acheive this is set the permissions to 711 on /home/sites:

rwx--x--x

Then a directory listing cannot be generated but files within it can still be accessed.

  • Seems like you are looking to prevent writable directories than directory listings ? – Lester T. Feb 21 '17 at 1:00
  • No it's directory listings I'm looking to prevent, hence the missing r bit. To prevent writing I would only need to avoid the w. Don't see how it seems that way when the question clearly states what I'm trying to do? – Nigel B. Peck Feb 21 '17 at 3:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.