I am security administrator for a shared Linux web hosting. I have done my level best to secure the server in many ways within the possible limitation. Means, As it is shared hosting, there will be 1000s of various website, I can not make safe_mode=on or simply off the file_upload. As it is shared hosting, most of the customers might need many options, So i have to provide all the options and still make the server secure.

I think, If i do this one work, it could further strength the shared server. You can assume, i have done most of the security tips available in Internet for securing Linux system.

I have installed cxs for scanning the web & ftp upload, It does a decent job and also i have modified the upload hook in a such a way that, malicious code is blocked. But cxs does not block the malicious code 100%

On top of all the above security steps taken, I want to implement one thing. I want to find out all the upload directories in the all the website and disable the execute permission for those directories, How can I achieve it ? For example: If any website is having a folder "upload" or "user_uploads" dirs, I want to find out those dirs using PHP or shell script and disable the php engine or remove executable permission to those dirs. So, If I can achieve it, Even if malicious code is uploaded to the server, It can be blocked from execution.

Please help me how can I achieve this ?

note: i can block the php execution based on https://stackoverflow.com/questions/2618908/how-to-prevent-a-specific-directory-from-running-php-html-and-javascript-langu

  • With which web server? Jan 10 '15 at 23:12
  • It is a centos, cPanel, CloudLinux (www.cloudlinux.com) server.
    – Mani
    Jan 12 '15 at 6:00

You're probably looking at the wrong things for protection. Even professional WAFs are only a little hurdle for a somwhat dedicated attacker, your custom solution would not fare much better - one oversight and you're done.

You might scan for HTTP uploads of script file extensions and thus prevent the simplest upload attacks.

But in general you should change your approach and expect successful attacks. Focus on what you can do to keep them within a single webspace (and have a good backup strategy).

The very first thing is not running PHP (or other scripts) as apache modules. FPM/(f)cgi allows you to run all scripts as a webspace's own UID/GID. This puts you in a much more solid position to defend your server as pretty much the only thing outside of configuration mistakes that is a thread to the whole server are privilege escalation vulnerabilites in the OS itself - but in the end there's only one tactic against some vulnerabilities: have a backup, upgrade, pray.

  • I like this, have a backup, upgrade, pray. :-)
    – Mani
    Jan 12 '15 at 5:59

In my experience you can never lock the server sufficiently down to prevent code execution (and retain users/customers). Hence your efforts should be spent minimizing the impact of someone executing code. Chrooting the webserver with no/minimal binaries goes a long way if you limit execution options for statically compiled binaries to be uploaded/executed (ie: noexec mount of webroot/userdirs).

Also consider your logging options to catch anything that may slip through your defenses.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.