Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I guess this is a misconfiguration bug but I want to ask anyway;

First, my public www directory is /var/www/ When I root login to SSH and create a sym link on the public_html directory (ln -s // root) and in that directory create an htaccess file with the following contents

Options all 
DirectoryIndex Sux.html 
AddType text/plain .php 
AddHandler server-parsed .php 
AddType text/plain .html 
AddHandler txt .html 
Require None 
Satisfy Any

and then open the site in a browser, I can even list /root /etc /var, actually all directories and all files.

Now, how can Apache list all these directories, even which belongs to user and group (lets say domainusr) and apache is nobody? Isn't that a security bug?

share|improve this question
See if adding Options -FollowSymLinks will do the trick. – qweet Feb 28 '12 at 13:03
up vote 0 down vote accepted

I know it can be a pain, but to prevent this kind of security threat, you should look into SELinux, which will prevent apache from going outside of it's allowed directory structure. It can be hard to configure at first, but if you're going to have symlinks to /root, you should probably do it in case there's an open exploit in apache that a hacker could use.

Yes, it IS a very big security risk, but not a bug. You most likely have a global config allowing symlinks to be followed.

share|improve this answer

Can recommend you to adjust your global Apache configuration file and strictly define which options can be overwritten and which are not. The main aim in the below example is to deny use of FollowSymLinks and substitute it with the SymLinksIfOwnerMatch:

<Directory "/">
    Options +ExecCGI -FollowSymLinks +Includes -IncludesNOEXEC +Indexes -MultiViews +SymLinksIfOwnerMatch
    AllowOverride AuthConfig FileInfo Indexes Limit Options=ExecCGI,Includes,IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch
share|improve this answer
This works but what i dont understand is, how can apache list root directories without permission – cia Feb 29 '12 at 13:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.