|
Okay, Just recently uncovered a very large exploit in my server. Any hosting account that was set up through the Kloxo controll panel is automatically part of the "Apache" user group. This means if someone uploads a shell in their hime directory eg /home/user/public_html they can go up twice until they are in the /home directory. From here they can then go to /home/user2/public_html etc. Any ideas how to stop this? Information Kloxo Centos5 Apache Regards Ben |
|||||||||||
|
|
Its questionable that you have a control panel that believes such a configuration is suitable for virtual hosting since an attacker can write to the folders it finds. A quick way of helping here is to set chmod 711 on /home, this will prevent browsing of the folders -- however this is not a long term option because this is security through obscurity only. To prevent writing to other users directories you would need to remove all affected users from the apache group and ensure that the permission set of the directory being used permitted only r-x for apache. That you can do using the 'everyone' bits on the server, or more suitably the setfacl command can permit apache only read and execute access to the specific folders.. When it comes to preventing browsing/reading it gets a little more difficult.. a common option here is to use a setuid helper to alter the ownerships of files being executed say with PHP (this is thorugh an application called suPHP). This allows you to set complete ownership of the directories to the affected user. Apache upon executing a PHP file will switch ownerships to the owner of that file. For this to work you need to permit still at least 711/600 for directories/files apache wants access to. Whilst this works, it comes with its own problems:
RHEL6 has some better support to address this problem by utilizing mod_selinux. It should fix the problems above, offer a higher level of security overall and allow you to be informed of a breach immediately. SELinux on its can help confine an attackers options by reducing the attack surface and/or by alerting you by tripping over a permission denial. But mod_selinux allows you to use the categories system of selinux to define unique credentials for each virtual host. You can install the package using yum, then in the mod_selinux.conf file in httpd/conf.d alter the line: to Finally in each virtual domain add: Where X differs from virtual host to virtual host. Finally, finish off by altering the categories of each /home/user folder to the relevant one setup inside of the http config. Now, an attacker whom attempts to spawn a shell has a much more difficult problem reading into the other virtual hosts! Not only this but most shells will not spawn correctly (or backshells) as the standard selinux policy prevents it. It will also alert you (typically setup to email you on a server) to the breach so you can immediately trace the problem. Edit: setfacl should say r-x now rwx |
||||
|
|
|
The default behavior in Kloxo is to give ownership to group "apache" as it's assumed you are not running a shared hosting service (single user/site). If you are doing shared hosting, go to "Web Server Config" and switch to "suPHP". Then all files will be owned by user:user and php scripts will also run as the user. A quick check in the wiki and forums of LxCenter would answer your question. Also pay attention to the information box at the top and botton of configuration pages. |
|||
|
|
|
Manage permissions yourself or ask for support from Kloxo developers. For exacly that purpose chroot was created. Look at this article for instance. Or gzillin other on the net. Or you can execute Apache for each virtualhost with it's user and grant file access to only this user. |
|||
|
|
