Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My /var/www folder is owned by root but www-data has write permissions on one of its subdirectories (a user upload folder, containing pictures only).

Is there anyway for a malicious user to navigate out of this specific subdirectory or even out of /var/www?

Is there anything I can do to tighten security for that?

Is chrooting useless in this case?

Thanks for your suggestions.

share|improve this question
up vote 2 down vote accepted

This type of vulnerability is called "directory traversal".

It's been a long while since Apache itself has had a traversal vulnerability itself, but it sounds like you're running your own code within Apache; that's where you'll need to focus on mitigating risk, particularly if you have code that loads other files or content from the filesystem (the uploads code, for instance).

You'll occasionally see entries in your logs from bots making requests like /../../../etc/passwd, but Apache isn't going to give them that content (at least not without a new vulnerability being discovered), so you'll just want to make sure that the same is true of your own code.

share|improve this answer
Hi, thanks for your response. You said particularly if you have code that loads other files or content from the filesystem. In my PHP code, I use functions such as unlink(), copy() and include(). Does that qualify as "code that loads other files"? Or are you referring to something like exec() etc..? Thanks again – ericd Sep 21 '12 at 13:46
@eric01 Yes - any time you're taking any kind of user input (or anything that comes from user input) and using it as part of those function calls, you need to be extremely careful with how you handle the user input. Say you have an upload script that lets a user specify the filename of their image; if a user's able to put ../ as part of their filename and the system doesn't prevent or sanitize it, you've got the beginnings of a nasty directory traversal. – Shane Madden Sep 21 '12 at 16:37
In my script, I only load $_FILES['photo']['tmp_name'], then I resize the image, and I save it under the name of a substr()'ed MD5 of two random numbers. So the files names are not linked to any of the user input. Would that be enough to prevent malicious behavior? Thanks a lot – ericd Sep 21 '12 at 21:17
Sounds like that should be fine - though where does the tmp_name come from? – Shane Madden Sep 21 '12 at 21:31
@eric01 Ok - just wanted to make sure you weren't saving or retrieving a file with that name. Should be ok. – Shane Madden Sep 22 '12 at 0:05

your file permissions should be 644 and directories should be 755. The only user which have permission should be www-data. Other users only have read only permissions. In your case that looks fine.

Put a daily scan of clam-av and LMD on your web root directory. If you are using any built-in frameworks verify the security with there site and always have the latest versions of the applications.

To montior the web root directory you should put inotify on /var/www so you should know which files edited, created and deleted on the filesystem. The first step of the hacker is put some files on the web root and then navigate into the filesystem so you should monitor that via inotify.

Always have the daily backup of the old files so you can compare the files if any edited newly on the web for malicious code.

All the files created in the images folder should not have execute permission also put a check that the uploaded file is image only, also check the extensions of the file.

Hope that helps.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.