Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Someone uploaded some folders/files on my webserver, all were uploaded in /tmp. How can i prevent these sort of things. For more information, you can see logs.

--2011-04-09 22:17:55--  http://abc.do.am/perl.txt
Resolving abc.do.am... 1.1.1.1
Connecting to abc.do.am|1.1.1.1|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 33372 (33K) [text/plain]
Saving to: `perl.txt'

     0K .......... .......... .......... ..                   100% 

48.3K=0.7s

2011-04-09 22:17:56 (48.3 KB/s) - `perl.txt' saved [33372/33372]

  % Total    % Received % Xferd  Average Speed   Time    Time     

Time  Current
                                 Dload  Upload   Total   Spent    

Left  Speed
100 33372  100 33372    0     0  3919k      0 --:--:-- --:--:-- 

--:--:-- 15.3M

By default in Linux everyone can write in /tmp and the files were upload by user apache because apache running under user apache.

I exactly do not know that these were upload or generated by a process but the works under apache.

share|improve this question
    
On a side note: You might want to mark some of your questions as 'solved' once someone posted an answer that helped you or solved the problem. –  Bart De Vos Apr 10 '11 at 15:21
    
Uh, what files were "uploaded" to /tmp, and how do you know they were uploaded and, say, not created by a process on your system? –  Andrew M. Apr 10 '11 at 16:03

1 Answer 1

If the user has access to all files in the system, (e.g. root or has root privileges) then it is hard to accomplish what you want without changing that user's privileges. Otherwise, you can simple just restrict access to /tmp to 770 or 775 or any other combination that does not include a write access. However, this might not be the best way because users do need to write to /tmp as its purpose is to contain data for short time periods and as an intermediate step. So I would not be very concerned with preventing users from writing or uploading to /tmp.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.