Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Okay, Just recently uncovered a very large exploit in my server. Any hosting account that was set up through the Kloxo controll panel is automatically part of the "Apache" user group.

This means if someone uploads a shell in their hime directory eg /home/user/public_html

they can go up twice until they are in the /home directory. From here they can then go to /home/user2/public_html etc.

Any ideas how to stop this?

Information Kloxo Centos5 Apache

Regards Ben

share|improve this question
    
Sounds more like a failure on the part of the sysadmin to avoid setting excessively open permissions... –  Ignacio Vazquez-Abrams Mar 21 '11 at 18:03
    
So, How can I fix that? –  Ben Mar 21 '11 at 18:17
    
First you need to learn what each of the permission bits mean. Then you need to determine the absolute minimum permissions required for each user's home directory. Then you need to apply the policy. –  Ignacio Vazquez-Abrams Mar 21 '11 at 18:19
    
It was since I did chown -R ben:apache /home/minecraf/server.log –  Ben Mar 21 '11 at 18:28
    
-R means recursive and you pointed it to a file. Are you sure you not mistakenly pointed this command on some upper level? –  Dmytro Leonenko Mar 21 '11 at 18:31

3 Answers 3

Manage permissions yourself or ask for support from Kloxo developers. For exacly that purpose chroot was created. Look at this article for instance. Or gzillin other on the net.

Or you can execute Apache for each virtualhost with it's user and grant file access to only this user.

share|improve this answer

Its questionable that you have a control panel that believes such a configuration is suitable for virtual hosting since an attacker can write to the folders it finds.

A quick way of helping here is to set chmod 711 on /home, this will prevent browsing of the folders -- however this is not a long term option because this is security through obscurity only.

To prevent writing to other users directories you would need to remove all affected users from the apache group and ensure that the permission set of the directory being used permitted only r-x for apache. That you can do using the 'everyone' bits on the server, or more suitably the setfacl command can permit apache only read and execute access to the specific folders..

setfacl -Rm apache:r-x /home/vhosts/*
setfacl -Rdm apache:r-x /home/vhosts/*

When it comes to preventing browsing/reading it gets a little more difficult.. a common option here is to use a setuid helper to alter the ownerships of files being executed say with PHP (this is thorugh an application called suPHP). This allows you to set complete ownership of the directories to the affected user. Apache upon executing a PHP file will switch ownerships to the owner of that file. For this to work you need to permit still at least 711/600 for directories/files apache wants access to.

Whilst this works, it comes with its own problems:

  • It permits an attacker r/w access in the folder they attacked.
  • The attacker can still browse out and attempt to read files and folders other people marked 777.
  • The attacker gains the privileges of the user they are attacking which is worth more than a normally limited apache account.
  • Execution has to be acheived via CGI which may not be ideal.
  • suPHP often has its own setup or maintenance problems that need to be addressed.

RHEL6 has some better support to address this problem by utilizing mod_selinux. It should fix the problems above, offer a higher level of security overall and allow you to be informed of a breach immediately.

SELinux on its can help confine an attackers options by reducing the attack surface and/or by alerting you by tripping over a permission denial. But mod_selinux allows you to use the categories system of selinux to define unique credentials for each virtual host.

You can install the package using yum, then in the mod_selinux.conf file in httpd/conf.d alter the line:

selinuxServerDomain *:s0:c0

to

selinuxServerDomain *:s0:c0.c1023

Finally in each virtual domain add:

selinuxDomainVal    *:s0.cX

Where X differs from virtual host to virtual host.

Finally, finish off by altering the categories of each /home/user folder to the relevant one setup inside of the http config.

Now, an attacker whom attempts to spawn a shell has a much more difficult problem reading into the other virtual hosts! Not only this but most shells will not spawn correctly (or backshells) as the standard selinux policy prevents it. It will also alert you (typically setup to email you on a server) to the breach so you can immediately trace the problem.

Edit: setfacl should say r-x now rwx

share|improve this answer

The default behavior in Kloxo is to give ownership to group "apache" as it's assumed you are not running a shared hosting service (single user/site).

If you are doing shared hosting, go to "Web Server Config" and switch to "suPHP". Then all files will be owned by user:user and php scripts will also run as the user.

A quick check in the wiki and forums of LxCenter would answer your question. Also pay attention to the information box at the top and botton of configuration pages.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.