Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to setup my new VPS with my couple sites.

nginx, php-fpm and other needed services installed.

I setup a nginx server block(virtual hosts) for my site, and then try to create a php file for test. Everything working well, but then I want to try echo file_get_contents('/etc/passwd') file for security check. And its work too, a test.php file can access my VPS etc/passwd file and more.

After I try echo shell_exec('ls /') and this show my root folders.

So is this normal? Or how can I prevent this. I want to deny access to all except /var/www for www-data user wich running php codes.

Sorry for my bad English.

Thanks.

share|improve this question

closed as off-topic by Iain, MadHatter, Jenny D, Tim Brigham, mdpc Apr 14 at 17:37

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – Iain, MadHatter, Jenny D, Tim Brigham
If this question can be reworded to fit the rules in the help center, please edit the question.

3  
If you have sensitive information in any of those files, then you've done something wrong. –  David Schwartz Apr 14 at 1:35
    
etc/passwd just for example, if can access here then access other files hosts too. –  musa Apr 14 at 9:54
    
You don't want to deny the user access - you want to deny web clients access to them. You really really need to read basic information about securely configuring nginx. –  Jenny D Apr 14 at 12:32
1  
I'm quiet unclear about your comment above me. Usually passwd file is readable for all users.If I were you, I will first check the permissions whether it been changed or not. Example of a default /etc/passwd file will be seen as -rw-r--r-- 1 root root 1708 Mar 9 09:38 /etc/passwd –  AzkerM Apr 14 at 12:34

2 Answers 2

The passwd file is readable by all users. This is perfectly normal. Same for /. Programs need access to /etc/passwd to map usernames to ids. The actual passwords are stored in /etc/shadow which is more restricted.

If for some reason you don't want programs seeing those file you should look at creating a chroot jail which provides it with its own fake root directory and a seperate copy of all needed files. But for most services this is unnecessary.

share|improve this answer

You can prevent access outside of proscribed boundaries by setting up and using AppArmour or SELinux.

What you're really saying here is: "scripts that I put on the system and run have access to read world-readable files on the system."

Yes, yes they do.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.