# Apache listing root directory with sym link

I guess this is a misconfiguration bug but I want to ask anyway;

First, my public www directory is /var/www/domain.com/public_html. When I root login to SSH and create a sym link on the public_html directory (ln -s // root) and in that directory create an htaccess file with the following contents

Options all
DirectoryIndex Sux.html
Require None
Satisfy Any


and then open the site in a browser, I can even list /root /etc /var, actually all directories and all files.

Now, how can Apache list all these directories, even domain.com which belongs to user and group (lets say domainusr) and apache is nobody? Isn't that a security bug?

-
See if adding Options -FollowSymLinks will do the trick. –  qweet Feb 28 '12 at 13:03

I know it can be a pain, but to prevent this kind of security threat, you should look into SELinux, which will prevent apache from going outside of it's allowed directory structure. It can be hard to configure at first, but if you're going to have symlinks to /root, you should probably do it in case there's an open exploit in apache that a hacker could use.

Yes, it IS a very big security risk, but not a bug. You most likely have a global config allowing symlinks to be followed.

-

Can recommend you to adjust your global Apache configuration file and strictly define which options can be overwritten and which are not. The main aim in the below example is to deny use of FollowSymLinks and substitute it with the SymLinksIfOwnerMatch:

<Directory "/">