3

I'm currently setting up my own Linux server running CentOs 6. To test the security on my server I wrote a PHP script that acts like a sort of "navigator". I can go one directory up, open the files, etc. etc.

The problem is, my tools allows me to go up till "/" and I am not very happy with this. Although Apache is being run as "nobody" it seems like it can reach every folder and file on the whole server.

I tried to solve this like cPanel did it, but since I don't have cPanel I don't exactly know how this is done.

Basically I have this:

/home/account/public_html /home/anotherAccount/public_html

I want to make it so that "anotherAccount" can not access the files of "account". Actually I would love it so "anotherAccount" can't even get outside it's own directory!

Yes, I know you are thinking: Install suPHP/fastcgi/suExec, but I can't do this because they are eating resources. I know it's possible without installing either one of them! I uploaded my script to some professional yet not very known webhost and I was able to go inside / with it, but not inside the home directories except my own. /home/ listed as empty!

How do I secure my home folders?

Improve this question
0

2 Answers 2

Reset to default
1

If you want that nobody can access your home folder, except yourself and root, you have to make sure that the other users have no permissions in your homedir. like this:

chmod o-rwx ~

This removes read, write and execute permissions from your home directory for other users.

If you also want to make sure that nobody from the group who owns your homedirectory can access it, you would also have to do this:

chmod g-rwx ~

This will also remove all permissions for groupmembers of the group that owns your directory.

if you want to know more details, check the manpage man 1 chmod and man 2 chmod. They should explain you all the details.

BTW. I would be scared to put a PHP script on my server that allows anybody to browser files, even if it only runs as user nobody.

Improve this answer
7
  • Thanks for your fast reply, however, this would mean that only root and the owner of the file can execute it, but PHP runs as apache module so the apache user should be able to run it. The twist here, is that apache should somehow "respect" the owner of the folder..
    – John Smith
    Feb 18, 2013 at 12:07
  • I'm not sure anymore if I understand you right. So your goal is that nobody can access your home folder right? Now Apache/PHP is running as another user than your own user. So if you remove the permissions from your home directory for all other users, this does include Apache+PHP
    – replay
    Feb 18, 2013 at 12:10
  • His problem is that every user can access all data on the server. So when someone has an account on his webhost, than that user can access the root. He doesn’t want that. The user only can access files in his folder. So he made a shell on his server, with that Shell he can access the root with a user on his server
    – Laurence
    Feb 18, 2013 at 12:18
  • If you want a shell which can't leave it's homedir you will need to execute it in a chroot. Like this you can build a rootjail. Here is a nice tutorial for howto do it: aarongifford.com/computers/chrsh.html
    – replay
    Feb 18, 2013 at 12:35
  • Okay let me try again: I made a PHP shell that is simply a directory listing and a path input. With this simple script I can navigate to / or whatever including other users' home. I tested my script on a professional hoster and I can also go to / or whatever EXCEPT for the homes of other users. I want this same protection so that "hackers" can not see the content of other users. In fact, I would like the home folder to be viewed as empty or "access denied". Note, every user has one or more domains assigned to it, so the sites should still be viewable.
    – John Smith
    Feb 18, 2013 at 12:56
0

The Apache user will always be able to read a large portion of the file system. Both by design and by default many locations are left readable (and sometimes executable) for all users. This is not, in itself, a problem.

What you need to ensure is that 1) Apache will not serve documents outside a specific set of directories and that 2) PHP is not allowed to go into any directories that do not hold your application's PHP files.

1) Use <Directory> entries to limit access and ensure that there are no unsafe defaults in any configuration files. This is slightly tangential to your question since what is serving the files is PHP, not apache. But it is still important to be mindful of;

2) Enable Safe Mode and set doc_root and open_basedir directives to ensure that PHP is restricted to a particular directory tree, for example open_basedir="/var/www/htdocs/<website>/";. These configuration options can be set in many places: from the system's php.ini to vhost dedicated php.ini files, to apache directives passed to the php interpreter, etc;

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .