Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to find out if I am on the right track.

My upload script that does the following:

  • Check if the extension is gif, png, jpg org jpeg
  • Check if mime is image/jpeg, image/png, image/gif
  • Check if a valid file was uploaded
  • Upload file to /images
  • .htaccess script in the /images that disables script Execution

After that I have set the following permissions for /images

  • owner/group = www-data
  • Permissions = 700

Question:

  • Does the last step where I set the permissions on /images make sense?

This is part of an e-commerce solution. The images that are uploaded while be shown on products, product lists etc. That means the visitors should have permisson the view the images.

I run apache 2.2 under the user www-data

share|improve this question
add comment

3 Answers 3

up vote 1 down vote accepted

Your setup will prevent any other user on the local system (aside from root) from doing anything with these files. This is sound enough, so long as no other service running under different privileges needs access. It depends what you plan to do with the images once they're uploaded.

However, this will not prevent someone with access to the site from uploading files. The apache service is running as www-data, so any file written to the disk by apache will be owned by that user.

If a hacker somehow bypasses your protection measures and gains access to the uploader, they will be able to upload files. The underlying filesystem has no way of knowing whether the files are coming from an authorised http user.

Edit

If I understand you correctly, your main concern is that someone compromises your upload script, uploads a new script file and executes by accessing it through your main site?

It's a sound idea to set the minimal necessary permissions on areas containing uploaded files. Your web application will also be running as www-data, I assume, so it will be able to display images to your end users.

However, it should be clear that preventing script execution in the way you desire is not a job for the file system. The execute bit is not relevant and the focus should be on ensuring your app is safe as well as taking the apache configuration measures you've listed.

share|improve this answer
    
Will the hacker be able to upload the files directly to the directory? I guess that was my question. –  Cudos Jan 6 '11 at 16:41
    
Can you edit your original post and perhaps detail the attack you're hoping to prevent? Where is this hacker and what access doe he/she have to your server? (If a hacker gets as far as getting local user access to your server - the point at which the filesystem permissions would make any difference - then you've got bigger problems to worry about, to put it bluntly.) –  SmallClanger Jan 6 '11 at 18:51
    
I have tried to clarify what I mean –  Cudos Jan 8 '11 at 11:55
    
Yes, that is my concern. I am a newbie in server security so sorry if my questions are stupid. Can the hacker upload a file directly to that directory without using the upload script? Does visitors get www-data privileges? –  Cudos Jan 10 '11 at 10:26
    
Any action taken by your application will be run as the www-data user on the system. You certainly need to make sure your upload script is protected and only accessible to authorised people; but allowing www-data to write to a folder doesn't grant your visitors any new rights, no. –  SmallClanger Jan 10 '11 at 10:53
show 1 more comment

No, you shouldn't need to set them, unless the 'upload script' write files with default permissions that are not readable by the www-data user or the file is explicitly wrote to a directory that is 'executable' with the execute bit enabled.

share|improve this answer
add comment

This makes no sense, your unprivileged webserver userid should not own any of the content it serves, and should not be able to write to any files it serves, which your doin gboth explicitly.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.