Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I guess this is a misconfiguration bug but I want to ask anyway;

First, my public www directory is /var/www/domain.com/public_html. When I root login to SSH and create a sym link on the public_html directory (ln -s // root) and in that directory create an htaccess file with the following contents

Options all 
DirectoryIndex Sux.html 
AddType text/plain .php 
AddHandler server-parsed .php 
AddType text/plain .html 
AddHandler txt .html 
Require None 
Satisfy Any

and then open the site in a browser, I can even list /root /etc /var, actually all directories and all files.

Now, how can Apache list all these directories, even domain.com which belongs to user and group (lets say domainusr) and apache is nobody? Isn't that a security bug?

share|improve this question
1  
See if adding Options -FollowSymLinks will do the trick. –  qweet Feb 28 '12 at 13:03

2 Answers 2

up vote 0 down vote accepted

I know it can be a pain, but to prevent this kind of security threat, you should look into SELinux, which will prevent apache from going outside of it's allowed directory structure. It can be hard to configure at first, but if you're going to have symlinks to /root, you should probably do it in case there's an open exploit in apache that a hacker could use.

Yes, it IS a very big security risk, but not a bug. You most likely have a global config allowing symlinks to be followed.

share|improve this answer

Can recommend you to adjust your global Apache configuration file and strictly define which options can be overwritten and which are not. The main aim in the below example is to deny use of FollowSymLinks and substitute it with the SymLinksIfOwnerMatch:

<Directory "/">
    Options +ExecCGI -FollowSymLinks +Includes -IncludesNOEXEC +Indexes -MultiViews +SymLinksIfOwnerMatch
    AllowOverride AuthConfig FileInfo Indexes Limit Options=ExecCGI,Includes,IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch
</Directory>
share|improve this answer
    
This works but what i dont understand is, how can apache list root directories without permission –  cia Feb 29 '12 at 13:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.