How to protect server uploads

Question

I want to upload .jpg images to my Linux server so that clients can re-download the files when they want. Supposing unknowingly there is a trojan, worm or malware in my computer, will these be uploaded and infect the client's computer ? how can this be prevented. where in the server should i check for any malicious programs.

Answer 1

1. Reinstall your system (as you say you are unknowing, if you feel your system has a virus, reinstall your system from scratch)
2. Install an antivirus on your computer
3. Install an antivirus on your server (yes, for Linux there are solutions as well)
4. You know have a bit more assurance that there will be no problems

But you can't, unfortunately, be 100% sure.

Another option is that, before uploading your jpeg, you upload it to virustotal and see what that gives. If it says one of your files is infected please jump to step 1.

Answer 2

Client Security

1. Anti Virus
2. Periodic Scanning
3. Download of latest anti virus definition
4. User Education

Server Security

1. Hardening with compliance to security standard probably NIST

2. IPS , Firewall and even antivirus for linux. I think some company support it.

3. Downloading of critical security patches and update patch regularly from trusted sources

4. Logging is important too.

Answer 3

If you can, code a virus check into the file-upload handler. As in, when your HTTP posted file is received, scan it with an AV before making it available to your end users. If it fails the AV check, bin it off.

ClamAV's tool, clamscan can do this from stdin, so the file might not even have to be saved in the first place.

You should regularly update the AVDB and periodically schedule re-checking of these files, just in case there is a new trojan that wasn't in the signatures when it was first uploaded.

Of course, if you are really worried, you could pipe the file through clamscan on its way out, too (i.e. on every HTTP/GET of that file).

If performance is a factor, you might prefer to stream the file to a staging/ directory and end the HTTP request with an HTTP/202 Accepted response. Then you can schedule your scan on that directory with a cron job (or something) to keep it out-of-band. Your scan process can then move successful files to a user_content/ directory, from which they can be served. You will need to lock down your web server config so that the staging/ directory can never be served directly.

As an aside, I would use a separate domain name to host user-uploaded data (and configure it so that the site should not be scanned by bots with robots.txt, etc) so that, if you get a stream of malware uploads, it is less likely to get your primary domain blacklisted.

Answer 4

It is possible that an advanced piece of malware on your desktop machine could detect the presence of an open SSH session, and use it to infect the server.

From there the malware could insert browser exploits into your web documents on the server and in turn, infect other clients that visit your web pages.

So yes, your scenario is possible, but we are talking about a fairly advanced and aggressive malware here, but it could happen.

The other answers have covered steps that you can follow, I would just add that you should avoid logging into your server as root. However any user that has write access to the web root could potentially be used to subvert the webserver and infect client browsers.

Answer 5

Best way to secure your uploaded files is to keep them out of the home directory of website. If you can't keep them out of home dir of website .Try to make the folder where images are stored as secured either via password, or giving the permissions as no-one , so that the folder cant be accessed via http.

if you think there is virus in there, it cant infect unless its executed or if its backdoor.You can install kaspersky antivirus on linux server as thats the best i can suggest it really scans all the files and folders.

What i suggest is if you want to keep your website from being hacked. use .htaccess in folder where you have kept the files and this works if you have apache and running php.

What you do is , to stop php engine in the directory of uploads so that php shell cant be executed no matter what happens. Or through .htaccess file you can create 500 internal server error in uploaded files directory. so no matter what is in the folder it doesn't effect. And still your files can be read through php and this way, everything works , fine.

There are many vulnerability scanner , that can be used to check if your server is infected, and through ssh you can ensure that all the processes running are genuine, but hey you need to ensure security aspect before running that type of website