0

I've set up a chrooted sftp folder following the instructions here: http://www.thegeekstuff.com/2012/03/chroot-sftp-setup/

It works fine, my only problem is it appears there is a glaring vulnerability that could potentially allow information on the server to be compromised if the user uploading the content is hacked.

Specifically, sftp allow you to create symbolic links, so for example if the drop folder is compromised all they have to do is sftp in and then:

sftp> symlink /etc/passwd web/user-list

And assuming that the web folder is is the web root for the website, then going to http://example.com/user-list will show the contents of /etc/passwd.

This allows read access to any file on the system, anywhere, that the web server user could have read access to — all they have to do is create a symbolic link pointing to it.

So, they could use the following to get a hold of our certificates in order to spoof our server:

sftp> symlink /etc/httpd/certs/example.key private-key
sftp> symlink /etc/httpd/certs/example.crt public-cert

So I guess my question is: is there any way to block this?

Improve this question
2
  • Chroot httpd too, and serverfault.com/questions/407497/… ??
    – ErikE
    Jul 29, 2015 at 20:57
  • 1
    Have you tried removing FollowSymLinks from httpd.conf, or replacing it with SymLinksIfOwnerMatch? The docs at httpd.apache.org/docs/2.2/mod/core.html say "This option should not be considered a security restriction, since symlink testing is subject to race conditions that make it circumventable" but at least it makes exploitation a lot harder.
    – Phil McKerracher
    Jul 29, 2015 at 23:50

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .