Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to setup my new VPS with my couple sites.

nginx, php-fpm and other needed services installed.

I setup a nginx server block(virtual hosts) for my site, and then try to create a php file for test. Everything working well, but then I want to try echo file_get_contents('/etc/passwd') file for security check. And its work too, a test.php file can access my VPS etc/passwd file and more.

After I try echo shell_exec('ls /') and this show my root folders.

So is this normal? Or how can I prevent this. I want to deny access to all except /var/www for www-data user wich running php codes.

Sorry for my bad English.


share|improve this question

closed as off-topic by Iain, MadHatter, Jenny D, Tim Brigham, mdpc Apr 14 '14 at 17:37

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – Iain, MadHatter, Jenny D, Tim Brigham
If this question can be reworded to fit the rules in the help center, please edit the question.

If you have sensitive information in any of those files, then you've done something wrong. – David Schwartz Apr 14 '14 at 1:35
etc/passwd just for example, if can access here then access other files hosts too. – musa Apr 14 '14 at 9:54
You don't want to deny the user access - you want to deny web clients access to them. You really really need to read basic information about securely configuring nginx. – Jenny D Apr 14 '14 at 12:32
I'm quiet unclear about your comment above me. Usually passwd file is readable for all users.If I were you, I will first check the permissions whether it been changed or not. Example of a default /etc/passwd file will be seen as -rw-r--r-- 1 root root 1708 Mar 9 09:38 /etc/passwd – AzkerM Apr 14 '14 at 12:34

2 Answers 2

up vote 12 down vote accepted

The passwd file is readable by all users. This is perfectly normal. Same for /. Programs need access to /etc/passwd to map usernames to ids. The actual passwords are stored in /etc/shadow which is more restricted.

If for some reason you don't want programs seeing those file you should look at creating a chroot jail which provides it with its own fake root directory and a seperate copy of all needed files. But for most services this is unnecessary.

share|improve this answer

You can prevent access outside of proscribed boundaries by setting up and using AppArmour or SELinux.

What you're really saying here is: "scripts that I put on the system and run have access to read world-readable files on the system."

Yes, yes they do.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.