Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm currently setting up my own Linux server running CentOs 6. To test the security on my server I wrote a PHP script that acts like a sort of "navigator". I can go one directory up, open the files, etc. etc.

The problem is, my tools allows me to go up till "/" and I am not very happy with this. Although Apache is being run as "nobody" it seems like it can reach every folder and file on the whole server.

I tried to solve this like cPanel did it, but since I don't have cPanel I don't exactly know how this is done.

Basically I have this:

/home/account/public_html /home/anotherAccount/public_html

I want to make it so that "anotherAccount" can not access the files of "account". Actually I would love it so "anotherAccount" can't even get outside it's own directory!

Yes, I know you are thinking: Install suPHP/fastcgi/suExec, but I can't do this because they are eating resources. I know it's possible without installing either one of them! I uploaded my script to some professional yet not very known webhost and I was able to go inside / with it, but not inside the home directories except my own. /home/ listed as empty!

How do I secure my home folders?

share|improve this question
    
See the open_basedir php ini flag. –  Christopher Feb 18 '13 at 15:09
add comment

1 Answer

If you want that nobody can access your home folder, except yourself and root, you have to make sure that the other users have no permissions in your homedir. like this:

chmod o-rwx ~

This removes read, write and execute permissions from your home directory for other users.

If you also want to make sure that nobody from the group who owns your homedirectory can access it, you would also have to do this:

chmod g-rwx ~

This will also remove all permissions for groupmembers of the group that owns your directory.

if you want to know more details, check the manpage man 1 chmod and man 2 chmod. They should explain you all the details.

BTW. I would be scared to put a PHP script on my server that allows anybody to browser files, even if it only runs as user nobody.

share|improve this answer
    
Thanks for your fast reply, however, this would mean that only root and the owner of the file can execute it, but PHP runs as apache module so the apache user should be able to run it. The twist here, is that apache should somehow "respect" the owner of the folder.. –  John Smith Feb 18 '13 at 12:07
    
I'm not sure anymore if I understand you right. So your goal is that nobody can access your home folder right? Now Apache/PHP is running as another user than your own user. So if you remove the permissions from your home directory for all other users, this does include Apache+PHP –  mauro.stettler Feb 18 '13 at 12:10
    
His problem is that every user can access all data on the server. So when someone has an account on his webhost, than that user can access the root. He doesn’t want that. The user only can access files in his folder. So he made a shell on his server, with that Shell he can access the root with a user on his server –  Laurence Feb 18 '13 at 12:18
    
If you want a shell which can't leave it's homedir you will need to execute it in a chroot. Like this you can build a rootjail. Here is a nice tutorial for howto do it: aarongifford.com/computers/chrsh.html –  mauro.stettler Feb 18 '13 at 12:35
    
Okay let me try again: I made a PHP shell that is simply a directory listing and a path input. With this simple script I can navigate to / or whatever including other users' home. I tested my script on a professional hoster and I can also go to / or whatever EXCEPT for the homes of other users. I want this same protection so that "hackers" can not see the content of other users. In fact, I would like the home folder to be viewed as empty or "access denied". Note, every user has one or more domains assigned to it, so the sites should still be viewable. –  John Smith Feb 18 '13 at 12:56
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.